📂 Vulnerable Library - eslint-webpack-plugin-2.4.0.tgz
A ESLint plugin for webpack
Findings
| Finding |
Severity |
🎯 CVSS |
Exploit Maturity |
EPSS |
Library |
Type |
Fixed in |
Remediation Available |
Reachability |
| CVE-2024-4068 |
🔴 High |
8.7 |
Not Defined |
< 1% |
braces-3.0.2.tgz |
Transitive |
N/A |
❌ |
 Reachable |
Details
🔴CVE-2024-4068
Vulnerable Library - braces-3.0.2.tgz
Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.
Library home page: https://registry.npmjs.org/braces/-/braces-3.0.2.tgz
Dependency Hierarchy:
-
react-dev-utils-12.0.1.tgz (Root Library)
- fork-ts-checker-webpack-plugin-6.5.2.tgz
- chokidar-3.5.3.tgz
- ❌ braces-3.0.2.tgz (Vulnerable Library)
-
webpack-dev-server-4.9.0.tgz (Root Library)
- chokidar-3.5.3.tgz
- ❌ braces-3.0.2.tgz (Vulnerable Library)
-
jest-29.1.2.tgz (Root Library)
- core-29.1.2.tgz
- micromatch-4.0.5.tgz
- ❌ braces-3.0.2.tgz (Vulnerable Library)
-
eslint-webpack-plugin-2.4.0.tgz (Root Library)
- micromatch-4.0.5.tgz
- ❌ braces-3.0.2.tgz (Vulnerable Library)
-
eslint-webpack-plugin-2.5.2.tgz (Root Library)
- micromatch-4.0.5.tgz
- ❌ braces-3.0.2.tgz (Vulnerable Library)
Reachability Analysis
This vulnerability is potentially reachable:
Vulnerability Details
The NPM package "braces", versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In "lib/parse.js," if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash. After conducting a further research, it was concluded that CVE-2024-4068 does not contain a high security risk that reflects the NVD score, but should be kept for users' awareness. Users of braces should follow the fix recommendation as noted.
Publish Date: May 13, 2024 10:06 AM
URL: CVE-2024-4068
Threat Assessment
Exploit Maturity:Not Defined
EPSS:< 1%
Score: 8.7
Suggested Fix
Type: Upgrade version
Origin: GHSA-grv7-fg5c-xmjg
Release Date: May 13, 2024 10:06 AM
Fix Resolution : braces - 3.0.3
📂 Vulnerable Library - eslint-webpack-plugin-2.4.0.tgz
A ESLint plugin for webpack
Findings
Details
🔴CVE-2024-4068
Vulnerable Library - braces-3.0.2.tgz
Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.
Library home page: https://registry.npmjs.org/braces/-/braces-3.0.2.tgz
Dependency Hierarchy:
react-dev-utils-12.0.1.tgz (Root Library)
webpack-dev-server-4.9.0.tgz (Root Library)
jest-29.1.2.tgz (Root Library)
eslint-webpack-plugin-2.4.0.tgz (Root Library)
eslint-webpack-plugin-2.5.2.tgz (Root Library)
Reachability Analysis
This vulnerability is potentially reachable:
Vulnerability Details
The NPM package "braces", versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In "lib/parse.js," if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash. After conducting a further research, it was concluded that CVE-2024-4068 does not contain a high security risk that reflects the NVD score, but should be kept for users' awareness. Users of braces should follow the fix recommendation as noted.
Publish Date: May 13, 2024 10:06 AM
URL: CVE-2024-4068
Threat Assessment
Exploit Maturity:Not Defined
EPSS:< 1%
Score: 8.7
Suggested Fix
Type: Upgrade version
Origin: GHSA-grv7-fg5c-xmjg
Release Date: May 13, 2024 10:06 AM
Fix Resolution : braces - 3.0.3