CVE-2021-29060
1 advisory.
npm/color-string CVE-2021-29060: medium 5.3, EPSS 3.13%
Regular Expression Denial of Service (ReDOS)
Action: Upgrade color-string to 1.5.5 or later.
npm i color-string@1.5.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.5.5 | - |
Fixed versions
| 1.5.5 |
Sources
- osv: GHSA-257v-vj4p-3w2h
- https://nvd.nist.gov/vuln/detail/CVE-2021-29060
- https://github.com/Qix-/color-string/commit/0789e21284c33d89ebc4ab4ca6f759b9375ac9d3
- https://github.com/Qix-/color-string/releases/tag/1.5.5
- https://github.com/yetingli/PoCs/blob/main/CVE-2021-29060/Color-String.md
- https://github.com/yetingli/SaveResults/blob/main/js/color-string.js
- https://www.npmjs.com/package/color-string
CVE-2021-29060 · published · modified · JSON