CVE-2024-27088 (Low) detected in multiple libraries

CVE-2024-27088 - Low Severity Vulnerability

Vulnerable Libraries - es5-ext-0.10.15.tgz, es5-ext-0.10.12.tgz, es5-ext-0.10.35.tgz, es5-ext-0.10.52.tgz, es5-ext-0.10.37.tgz, es5-ext-0.10.29.tgz, es5-ext-0.10.53.tgz

es5-ext-0.10.15.tgz

ECMAScript extensions and shims

Library home page: https://registry.npmjs.org/es5-ext/-/es5-ext-0.10.15.tgz

Path to dependency file: /fixtures/ssr/package.json

Path to vulnerable library: /fixtures/ssr/package.json

Dependency Hierarchy: - react-scripts-0.9.5.tgz (Root Library) - eslint-3.16.1.tgz - escope-3.6.0.tgz - es6-map-0.1.5.tgz - :x: **es5-ext-0.10.15.tgz** (Vulnerable Library)

es5-ext-0.10.12.tgz

ECMAScript extensions and shims

Library home page: https://registry.npmjs.org/es5-ext/-/es5-ext-0.10.12.tgz

Path to dependency file: /fixtures/fiber-debugger/package.json

Path to vulnerable library: /fixtures/fiber-debugger/node_modules/es5-ext/package.json,/fixtures/dom/package.json

Dependency Hierarchy: - react-scripts-0.9.5.tgz (Root Library) - eslint-3.16.1.tgz - escope-3.6.0.tgz - es6-map-0.1.4.tgz - :x: **es5-ext-0.10.12.tgz** (Vulnerable Library)

es5-ext-0.10.35.tgz

ECMAScript extensions and shims

Library home page: https://registry.npmjs.org/es5-ext/-/es5-ext-0.10.35.tgz

Path to dependency file: /fixtures/packaging/systemjs-builder/dev/package.json

Path to vulnerable library: /fixtures/packaging/systemjs-builder/dev/package.json,/fixtures/packaging/systemjs-builder/prod/package.json,/fixtures/expiration/package.json

Dependency Hierarchy: - systemjs-builder-0.15.36.tgz (Root Library) - es6-template-strings-2.0.1.tgz - :x: **es5-ext-0.10.35.tgz** (Vulnerable Library)

es5-ext-0.10.52.tgz

ECMAScript extensions and shims

Library home page: https://registry.npmjs.org/es5-ext/-/es5-ext-0.10.52.tgz

Path to dependency file: /fixtures/flight/package.json

Path to vulnerable library: /fixtures/flight/package.json

Dependency Hierarchy: - resolve-url-loader-3.1.0.tgz (Root Library) - es6-iterator-2.0.3.tgz - :x: **es5-ext-0.10.52.tgz** (Vulnerable Library)

es5-ext-0.10.37.tgz

ECMAScript extensions and shims

Library home page: https://registry.npmjs.org/es5-ext/-/es5-ext-0.10.37.tgz

Path to dependency file: /fixtures/concurrent/time-slicing/package.json

Path to vulnerable library: /fixtures/concurrent/time-slicing/package.json

Dependency Hierarchy: - react-scripts-1.1.4.tgz (Root Library) - webpack-3.8.1.tgz - escope-3.6.0.tgz - es6-map-0.1.5.tgz - :x: **es5-ext-0.10.37.tgz** (Vulnerable Library)

es5-ext-0.10.29.tgz

ECMAScript extensions and shims

Library home page: https://registry.npmjs.org/es5-ext/-/es5-ext-0.10.29.tgz

Path to dependency file: /fixtures/attribute-behavior/package.json

Path to vulnerable library: /fixtures/attribute-behavior/package.json

Dependency Hierarchy: - react-scripts-1.0.11.tgz (Root Library) - webpack-3.5.1.tgz - escope-3.6.0.tgz - es6-map-0.1.5.tgz - :x: **es5-ext-0.10.29.tgz** (Vulnerable Library)

es5-ext-0.10.53.tgz

ECMAScript extensions and shims

Library home page: https://registry.npmjs.org/es5-ext/-/es5-ext-0.10.53.tgz

Path to dependency file: /fixtures/blocks/package.json

Path to vulnerable library: /fixtures/blocks/package.json

Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - resolve-url-loader-3.1.1.tgz - es6-iterator-2.0.3.tgz - :x: **es5-ext-0.10.53.tgz** (Vulnerable Library)

Found in HEAD commit: 4669645897ed4ebcd4ee037f4dabb509ed4754c7

Found in base branch: master

Vulnerability Details

es5-ext contains ECMAScript 5 extensions. Passing functions with very long names or complex default argument names into `function#copy` or `function#toStringTokens` may cause the script to stall. The vulnerability is patched in v0.10.63.

Publish Date: 2024-02-26

URL: CVE-2024-27088

CVSS 3 Score Details (0.0)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: High - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix