CVE-2024-27088

2024-02-2617:15:11

Google

osv.dev

es5 extensions

function copy

function tostringtokens

script stall

vulnerability

patched software

0 Low

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N

7 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.7%

JSON

es5-ext contains ECMAScript 5 extensions. Passing functions with very long names or complex default argument names into function#copy or function#toStringTokens may cause the script to stall. The vulnerability is patched in v0.10.63.

CPENameOperatorVersion
es5-exteq0.10.32
es5-exteq0.10.47
es5-exteq0.10.10
es5-exteq0.10.49
es5-exteq0.10.2
es5-exteq0.10.13
es5-exteq0.10.9
es5-exteq0.10.21
es5-exteq0.2.1
es5-exteq0.10.53

Name	Operator	Version
es5-ext	eq	0.10.32
es5-ext	eq	0.10.47
es5-ext	eq	0.10.10
es5-ext	eq	0.10.49
es5-ext	eq	0.10.2
es5-ext	eq	0.10.13
es5-ext	eq	0.10.9
es5-ext	eq	0.10.21
es5-ext	eq	0.2.1
es5-ext	eq	0.10.53