MEDIUM6.5

GHSA-7xrj-f5rp-j55h

Uncontrolled Resource Consumption in transpile

Details

All versions of package transpile are vulnerable to Denial of Service (DoS) due to a lack of input sanitization or whitelisting, coupled with improper exception handling in the .to() function.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/transpile

Introduced in: 0

No fixed version published yet for transpile (npm). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2021-23429[ADVISORY]
https://github.com/stealjs/transpile[PACKAGE]
https://github.com/stealjs/transpile/blob/56aaeb26f69496e45a60c03dc92653d53021d4ac/main.js%23L53[WEB]
https://snyk.io/vuln/SNYK-JS-TRANSPILE-1290774[WEB]