Vision Ui · Vision Ui · CVE-2025-54884
**Name of the Vulnerable Software and Affected Versions**
Vision UI versions 1.4.0 and below
**Description**
The `generateSecureId` and `getSecureRandomInt` functions within the `security-kit` component (versions prior to 3.5.0, packaged in Vision UI 1.4.0 and below) are susceptible to Denial of Service (DoS) attacks. The `generateSecureId(length)` function directly utilizes the `length` parameter to determine the size of a `Uint8Array` buffer. This allows attackers to deplete server memory by repeatedly requesting large IDs. The `getSecureRandomInt(min, max)` function calculates buffer size based on the range between `min` and `max`, and large ranges can lead to excessive memory allocation and CPU-intensive rejection-sampling loops, potentially causing thread hangs.
**Recommendations**
Update to Vision UI version 1.5.0 or later.
Update the `security-kit` component to version 3.5.0 or later.