Skip to content

update 10109 #187

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

update 10109 #187

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d1fce61
update 10109
sampion88 Feb 24, 2025
7bd132f
simplify howto
sampion88 Feb 25, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions vulnerabilities/AIKIDO-2025-10109.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
],
"vulnerable_ranges": [
[
"5.0.0",
"4.0.0",
"5.1.1"
]
],
Expand All @@ -14,7 +14,7 @@
],
"tldr": "The latest version of `xregexp` (5.1.1) is vulnerable to prototype pollution through the `XRegExp.cache` function. An attacker can supply a crafted payload with a pattern and flag to manipulate properties within the global prototype chain. This vulnerability can lead to more severe injection-based attacks, depending on how the library is used. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., `exec`, `eval`), an attacker could execute arbitrary commands within the application's context.",
"doest_this_affect_me": "You are affected if you are using a version that falls within the vulnerable range.",
"how_to_fix": "Upgrade the `xregexp` library to the patch version.",
"how_to_fix": "Upgrade the `xregexp` library to the latest patched version. If you're updating from a version older than `5.0.0`, be aware of breaking changes in `5.x`:\n Namespacing is now enabled by default, Named capture groups are handled differently and Support for Unicode blocks has been removed. \nCheck the `xregexp` changelog for more details before upgrading.",
"reporter": "",
"vulnerable_to": "Prototype Pollution",
"related_cve_id": "",
Expand Down
Loading