PT-2020-19769 · Dat · Dat.Gui

Yeting Li · Published 2020-10-27 · Updated 2025-01-07 · CVE-2020-7755

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions dat.gui versions prior to a fixed version

Description The issue is related to Regular Expression Denial of Service (ReDoS) via specifically crafted rgb and rgba values. This can be exploited in all versions of the package dat.gui.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2020-7755

GHSA-CHWR-HF3W-C984

SNYK-JS-DATGUI-1016275

Affected Products

Dat.Gui

References · 8

• 🔥 https://github.com/dataarts/dat.gui/issues/278 · Exploit
• https://osv.dev/vulnerability/GHSA-chwr-hf3w-c984 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7755 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7755 · Vendor Advisory
• https://github.com/dataarts/dat.gui/pull/279 · Note
• https://snyk.io/vuln/SNYK-JS-DATGUI-1016275 · Note
• https://npmjs.com/package/dat.gui · Note
• https://t.me/cvenotify/106661 · Telegram Post