Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTU3MjYtZzZyOS01ZjIy

Potential for Script Injection in syntax-error

Versions of syntax-error prior to 1.1.1 are affected by a cross-site scripting vulnerability which may allow a malicious file to execute code when browserified.

Recommendation

Update to version 1.1.1 or later.

Permalink: https://github.com/advisories/GHSA-5726-g6r9-5f22
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTU3MjYtZzZyOS01ZjIy
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 7 years ago
Updated: almost 2 years ago

EPSS Percentage: 0.28295
EPSS Percentile: 0.96839

Identifiers: GHSA-5726-g6r9-5f22, CVE-2014-7192
References:

• https://nvd.nist.gov/vuln/detail/CVE-2014-7192
• https://github.com/advisories/GHSA-5726-g6r9-5f22
• https://www.npmjs.com/advisories/37
• https://github.com/substack/node-syntax-error/commit/9aa4e66eb90ec595d2dba55e6f9c2dd9a668b309
• https://exchange.xforce.ibmcloud.com/vulnerabilities/96728
• http://www-01.ibm.com/support/docview.wss?uid=swg21690815
• https://github.com/substack/node-browserify/blob/master/changelog.markdown#421

Repository: https://github.com/substack/node-syntax-error
Blast Radius: 0.0

Affected Packages