Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The HTMLInputElement.checkValidity() method constructed a RegExp directly from the user-controlled pattern property without any sanitization or timeout protection. This allowed an attacker to inject a regex with catastrophic backtracking, freezing the event loop. Fix Fixed in commit https://github.com/asymmetric-effort/NogginLessDom/commit/25a3cbac665fae5663f8b71c073b80c3152dbe7b on main. Added: - Pattern length limit (1024 characters) - Nested quantifier detection (hasNestedQuantifiers) that rejects patterns like (a+)+ before constructing the regex - Patterns exceeding limits are treated as non-matching (safe default)
Recommended action: Upgrade to 0.0.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The matchFileSnapshot function in src/assertions/snapshots.ts accepted a filePath parameter with zero validation. When snapshot update mode was active (UPDATESNAPSHOTS=1 or setUpdateMode('all')), an attacker who controls test input could write arbitrary content to any filesystem path the process has write access to, including creating intermediate directories. Affected Code File: src/assertions/snapshots.ts, lines 732-769 The filePath flows from expect(value).toMatchFileSnapshot(filePath) at index.ts:1033-1035 with no sanitization, no check that the path is within an expected directory, and no symlink resolution. Proof of Concept Impact In CI/CD environments where test files may come from untrusted pull requests, this allows writing to any writable filesystem location with directory creation. An attacker could overwrite configuration files, inject code into build artifacts, or modify CI pipeline definitions. Fix Fixed in commit…
Recommended action: Upgrade to 0.0.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.