Описание
@asymmetric-effort/specifyjs: data: URI allowed without size restriction
Finding
Location: core/src/shared/secure-fetch.ts:33-35
data: URIs were allowed without any restriction. While data: URIs don't make network requests, they can be used for memory exhaustion via very large data URIs.
Status
Fixed in v0.2.136 — data: URIs are now limited to 1MB. URIs exceeding this limit throw an error.
Пакеты
Наименование
@asymmetric-effort/specifyjs
npm
Затронутые версииВерсия исправления
< 0.2.136
0.2.136
6.9 Medium
CVSS4
Дефекты
CWE-918
6.9 Medium
CVSS4
Дефекты
CWE-918