Regular Expression Denial of Service (ReDoS)

The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service ReDoS. If an attacker provides a malicious string, is-svg will get stuck processing the input...

02-infrastructure (1.0.0), 02vue_toast_demo (>=1.0.0, <=1.0.4) +11769 more potentially affected by CVE-2021-28092 +1 more via is-svg (>=2.1.0, <=4.2.2)

is-svg NPM version =2.1.0, =1.0.0, =1.0.4, =5.0.0, =1.0.3, =0.0.1, =1.0.2, =2.0.0, =1.1.8, =1.0.0, =1.0.4 - 4design 0.0.1 and more Source cves: CVE-2021-28092, CVE-2021-29059 Source advisory: SNYK:JS-ISSVG-1243891...

CVE-2021-28092

A flaw was found in is-svg package. A malicious string provided by an attacker may lead to Regular Expression Denial of Service ReDoS. The highest threat from this vulnerability is to availability...

Regular Expression Denial Of Service (ReDoS)

is-svg is vulnerable to regular expression denial of service. An attacker is able to crash the application via a malicious SVG/XML document due to the usage of an insecure regular expression...

CVE-2021-28092

The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service ReDoS. If an attacker provides a malicious string, is-svg will get stuck processing the input for a very long time...

CVE-2021-28092

The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service ReDoS. If an attacker provides a malicious string, is-svg will get stuck processing the input for a very long time...

Design/Logic Flaw

The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service ReDoS. If an attacker provides a malicious string, is-svg will get stuck processing the input for a very long time...

CVE-2021-28092

CVE-2021-28092 affects the is-svg npm package for Node.js (versions 2.1.0–4.2.1), where a regex-based ReDoS can cause input processing to stall, leading to a potential denial of service. In CP4S context, remediation guidance available: upgrade Cloud Pak for Security to version 1.9.0 or later. Evi...

Sindre Sorhus is-svg 安全漏洞

Sindre Sorhus is-svg is Sindre Sorhus an open source application. Provides a string or buffer to check whether the SVG function . A security vulnerability exists in is-svg package 2.1.0 through 4.2.1, which can be exploited by an attacker to supply a malicious string, causing is-svg to be unable ...

PT-2021-17738 · Npm · Is-Svg

Name of the Vulnerable Software and Affected Versions: is-svg package versions 2.1.0 through 4.2.1 Description: The issue concerns a Regular Expression Denial of Service ReDoS vulnerability in the is-svg package for Node.js. If an attacker provides a malicious string, the package will get stuck...

CVE-2021-28092: Inefficient Regular Expression Complexity

The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service ReDoS. If an attacker provides a malicious string, is-svg will get stuck processing the input for a very long time...