Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
brace-expansion: Zero-step sequence causes process hang and memory exhaustion
Vulnerability Description
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Vulnerability Title
brace-expansion 资源管理错误漏洞
Vulnerability Description
brace-expansion是Julian Gruber个人开发者的一个JavaScript中的Brace扩展。 brace-expansion 5.0.5之前版本、3.0.2之前版本、2.0.3之前版本和1.1.13之前版本存在资源管理错误漏洞，该漏洞源于步长值为零的括号模式导致序列生成循环无限运行，可能导致拒绝服务。
CVSS Information
N/A
Vulnerability Type
N/A