In breve
- CVE-2024-21524 è una vulnerabilità CRITICO (CVSS 9.1) che riguarda stringbuilder (magiclen), node-stringbuilder.
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.87%, superiore al 59.0% delle vulnerabilità.
- Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.
Description
All versions of the package node-stringbuilder are vulnerable to Out-of-bounds Read due to incorrect memory length calculation, by calling ToBuffer, ToString, or CharAt on a StringBuilder object with a non-empty string value input. It's possible to return previously allocated memory, for example, by providing negative indexes, leading to an Information Disclosure.
NVD description
All versions of the package node-stringbuilder are vulnerable to Out-of-bounds Read due to incorrect memory length calculation, by calling ToBuffer, ToString, or CharAt on a StringBuilder object with a non-empty string value input. It's possible to return previously allocated memory, for example, by providing negative indexes, leading to an Information Disclosure.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free