high7.5
CVE-2020-7755
Regular Expression Denial of Service in dat.gui
Impact
All versions of package dat.gui are vulnerable to Regular Expression Denial of Service (ReDoS) via specifically crafted rgb and rgba values.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | dat.gui | <= 0.7.7 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dat.Gui Project | Dat.Gui | before 0.7.8 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/dataarts/dat.gui/issues/278
- https://snyk.io/vuln/SNYK-JS-DATGUI-1016275
- https://github.com/advisories/GHSA-chwr-hf3w-c984
- https://nvd.nist.gov/vuln/detail/CVE-2020-7755
- https://github.com/dataarts/dat.gui/pull/279
- https://www.npmjs.com/package/dat.gui