CVE-2021-28092
High
Description
The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service (ReDoS). If an attacker provides a malicious string, is-svg will get stuck processing the input for a very long time.
SeverityHigh
CVSS7.5
Exploit probability—
ProductIs-svg
PublishedMar 12, 2021
First seenMar 12, 2021
How to fix
Update
- is-svg4.2.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| is-svg_project is-svg | 2.1.0 ≤ v ≤ 4.2.1 | — |
| is-svgnpm | 2.1.0 ≤ v < 4.2.2 | 4.2.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.