Description (CNA)
CSSOM through 0.5.0 contains a denial of service vulnerability in CSSStyleDeclaration.setProperty() that fails to validate reserved property names. Attackers can supply a stylesheet with a declaration named length to replace the internal counter and trigger excessive memory allocation during cssText serialization, causing process termination.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| NV / CSSOM | affected 0 through 0.5.0 |
CWE
CWE-915
References
- https://github.com/NV/CSSOM/issues/119
- https://github.com/NV/CSSOM
- https://github.com/NV/CSSOM/blob/00ec21868e12422581c81779135c2f1648441204/lib/CSSStyleDeclaration.js#L41-L56
- https://github.com/NV/CSSOM/blob/00ec21868e12422581c81779135c2f1648441204/lib/CSSStyleDeclaration.js#L112-L124
- https://www.vulncheck.com/advisories/cssom-through-0.5.0-denial-of-service-via-length-property
ADP enrichment
No English description supplied.