Description
Vulnerable Library - vue-2.6.14.tgz
Reactive, component-oriented view layer for modern web interfaces.
Library home page: https://registry.npmjs.org/vue/-/vue-2.6.14.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/vue/package.json
Found in HEAD commit: 1e5781423c543a0c9bfedb4c5a57ca049920974b
Vulnerabilities
| CVE | Severity |  CVSS |
Exploit Maturity | EPSS | Dependency | Type | Fixed in (vue version) | Remediation Possible** | Reachability |
|---|---|---|---|---|---|---|---|---|---|
| CVE-2024-9506 |  Low |
3.7 | Not Defined | 0.0% | vue-2.6.14.tgz | Direct | vue - 3.0.0 | ✅ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2024-9506
Vulnerable Library - vue-2.6.14.tgz
Reactive, component-oriented view layer for modern web interfaces.
Library home page: https://registry.npmjs.org/vue/-/vue-2.6.14.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/vue/package.json
Dependency Hierarchy:
- ❌ vue-2.6.14.tgz (Vulnerable Library)
Found in HEAD commit: 1e5781423c543a0c9bfedb4c5a57ca049920974b
Found in base branch: main
Vulnerability Details
Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability.
Publish Date: 2024-10-15
URL: CVE-2024-9506
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.0%
CVSS 3 Score Details (3.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: GHSA-5j4c-8p2g-v4jx
Release Date: 2024-10-15
Fix Resolution: vue - 3.0.0
⛑️ Automatic Remediation will be attempted for this issue.
⛑️Automatic Remediation will be attempted for this issue.
Activity