{"action":"Upgrade uglifier to 2.7.2 or later.","affected":[{"fixed":"2.7.2","introduced":"0"}],"component":"uglifier","cve_ids":["CVE-2015-8857"],"ecosystem":"RubyGems","epss":0.03559,"exploited":false,"fixed_versions":["2.7.2"],"ghsa_id":"GHSA-34r7-q49f-h37c","id":"tcs_01M5KEG68D8Y9GV3DDPPZBN8RN","modified_at":"2024-02-16T08:16:42.823655Z","published_at":"2017-10-24T18:33:36Z","references":["https://osv.dev/vulnerability/GHSA-34r7-q49f-h37c","https://nvd.nist.gov/vuln/detail/CVE-2015-8857","https://github.com/mishoo/UglifyJS2/issues/751","https://github.com/lautis/uglifier/commit/4677bfe38142937ff952f95605bcec4618892c3e","https://github.com/mishoo/UglifyJS2","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uglifier/CVE-2015-8857.yml","https://web.archive.org/web/20200227190830/http://www.securityfocus.com/bid/96410","https://zyan.scripts.mit.edu/blog/backdooring-js","http://www.openwall.com/lists/oss-security/2016/04/20/11"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-34r7-q49f-h37c#RubyGems/uglifier","url":"https://osv.dev/vulnerability/GHSA-34r7-q49f-h37c"}],"summary":"Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js"}