npm/is-svg CVE-2021-29059: high 7.5, EPSS 2.63%

ReDOS in IS-SVG

Action: Upgrade is-svg to 4.3.0 or later.

npm i is-svg@4.3.0

Affected

Fixed versions

Sources

• osv: GHSA-r8j5-h5cx-65gg
• https://nvd.nist.gov/vuln/detail/CVE-2021-29059
• https://github.com/sindresorhus/is-svg/commit/732fc72779840c45a30817d3fe28e12058592b02
• https://github.com/sindresorhus/is-svg
• https://github.com/sindresorhus/is-svg/releases/tag/v4.3.0
• https://github.com/yetingli/PoCs/blob/main/CVE-2021-29059/IS-SVG.md
• https://github.com/yetingli/SaveResults/blob/main/js/is-svg.js
• https://www.npmjs.com/package/is-svg

CVE-2021-29059 · published 2021-12-10T19:02:37Z · modified 2023-11-08T04:05:32.612152Z · JSON