Karimtantawey

**Name of the Vulnerable Software and Affected Versions** @xmldom/xmldom versions prior to 0.8.13 @xmldom/xmldom versions prior to 0.9.10 xmldom versions 0.6.0 and earlier **Description** Seven recursive traversals in `lib/dom.js` operate without a depth limit. When processing a sufficiently deeply nested DOM tree, the JavaScript call stack is exhausted, resulting in a `RangeError: Maximum call stack size exceeded` and crashing the application. This can lead to a denial of service if a service accepts attacker-controlled XML and performs any of the affected operations. The affected functions and entry points include - `Node.prototype.normalize()` - `XMLSerializer.serializeToString()` - `Element.getElementsByTagName()`, `getElementsByTagNameNS()`, `getElementsByClassName()`, and `getElementById()` (via the ` visitNode` function) - `Node.cloneNode(true)` - `Document.importNode(node, true)` - `node.textContent` (getter) - `Node.isEqualNode(other)` **Recommendations** Update @xmldom/xmldom to version 0.8.13 or 0.9.10. Update xmldom to a version later than 0.6.0. As a temporary workaround, restrict the use of the affected functions or limit the nesting depth of XML documents before they are processed by the library.

**Name of the Vulnerable Software and Affected Versions** @node-oauth/oauth2-server (affected versions not specified) **Description** The token exchange path accepts invalid `code verifier` values, including one-character strings, for S256 PKCE (Proof Key for Code Exchange) flows, which contradicts RFC7636. Since short or weak verifiers are permitted and failed attempts do not invalidate the authorization code, an attacker who intercepts an authorization code can perform an online brute-force attack on `code verifier` guesses to obtain a token. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** jsPDF versions prior to 4.1.0 **Description** jsPDF is a JavaScript library used to generate PDF documents. A flaw exists in the `addJS` method within the Node.js build, versions prior to 4.1.0, due to the use of a shared module-scoped variable (`text`) for storing JavaScript content. In concurrent environments, such as Node.js web servers, this shared variable can lead to Cross-User Data Leakage. Specifically, JavaScript content intended for one user may be overwritten by content from another request before the PDF is fully generated, resulting in a PDF for User A containing the JavaScript payload meant for User B. This issue primarily affects server-side environments, but similar race conditions could potentially occur in client-side implementations. **Recommendations** Update to jsPDF version 4.1.0 or later.

**Name of the Vulnerable Software and Affected Versions** jsPDF versions prior to 4.1.0 **Description** jsPDF is a JavaScript library used to generate PDF documents. A flaw exists due to user-controlled input to the `addMetadata` function, allowing arbitrary XML injection. If unsanitized input is provided to the `addMetadata` method, a user can inject arbitrary XMP metadata into the generated PDF. This can compromise the integrity of the PDF if it is subsequently signed or processed. The example attack vector demonstrates injecting a fake "dc:creator" (Author) to spoof the document source. The vulnerable function is `addMetadata`. The first argument of the `addMetadata` function is the vulnerable parameter. **Recommendations** Versions prior to 4.1.0 should be updated to version 4.1.0 or later. Sanitize user input before passing it to the `addMetadata` method by escaping XML entities. For example, replace '&' with '&amp;', '<' with '&lt;', '>' with '&gt;', '"' with '&quot;', and "'" with '&apos;'.

**Name of the Vulnerable Software and Affected Versions** jsPDF versions prior to 4.1.0 **Description** jsPDF is a JavaScript library used to generate PDFs. A flaw exists where user-controlled input to the `addImage` method can lead to a denial of service. Specifically, providing a malicious BMP image with large width and/or height values in its header can cause excessive memory allocation, resulting in out-of-memory errors. The `html` method is also affected by this issue. The `addImage` function is vulnerable due to the lack of sanitization of image data or URLs. An example attack involves providing malicious BMP image data as the first argument to the `addImage` function. **Recommendations** Update to jsPDF version 4.1.0 or later. Sanitize image data or URLs before passing them to the `addImage` method or the `html` method.