You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula's parser might lead to polynomial execution time and a denial of service. Users should upgrade to 3.0.1+. There are no known workarounds for this vulnerability.
CVE-2023-25166 - Medium Severity Vulnerability
Math and string formula parser.
Library home page: https://registry.npmjs.org/@sideway/formula/-/formula-3.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/@sideway/formula/package.json
Dependency Hierarchy:
Found in HEAD commit: cbd15ae823f3767bc711f07ffa6b936149446d6a
Found in base branch: master
formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula's parser might lead to polynomial execution time and a denial of service. Users should upgrade to 3.0.1+. There are no known workarounds for this vulnerability.
Publish Date: 2023-02-08
URL: CVE-2023-25166
Base Score Metrics:
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-25166
Release Date: 2023-02-08
Fix Resolution: @sideway/formula - 3.0.1
Step up your Open Source Security Game with Mend here
The text was updated successfully, but these errors were encountered: