PT-2023-11819 · Mholt · Papaparse

Mholt · Published 2020-09-04 · Updated 2024-05-17 · CVE-2020-36649

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions mholt PapaParse versions up to 5.1.x

Description A vulnerability was found in the file papaparse.js, leading to inefficient regular expression complexity. The issue is classified as problematic and affects an unknown function. Upgrading to version 5.2.0 addresses this issue.

Recommendations For versions up to 5.1.x, upgrade to version 5.2.0 to address the issue.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

CWE-185

Related Identifiers

CVE-2020-36649

GHSA-798H-G4J5-5537

GHSA-QVJC-G5VR-MFGR

MGASA-2023-0204

Affected Products

Papaparse

References · 28

• 🔥 https://github.com/mholt/PapaParse/issues/777 · Exploit
• https://github.com/mholt/PapaParse/commit/235a12758cd77266d2e98fd715f53536b34ad621 · Patch
• https://github.com/mholt/PapaParse/pull/779 · Patch
• https://github.com/mholt/PapaParse/releases/tag/5.2.0 · Patch
• https://osv.dev/vulnerability/MGASA-2023-0204 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36649 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-36649 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/ZGK4NZPIJ5ET2ANRZOUYPCRIB5I64JR7 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-36649 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/AP65YEN762IBNQPOYGUVLTQIDLM5XD2A · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36649 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-36649 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0204.html · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-36649 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-36649 · Vendor Advisory