2vulnerabilities
- Critical0 (0.0%)
- High1 (50.0%)
- Medium0 (0.0%)
- Moderate1 (50.0%)
- Low0 (0.0%)
asymmetric-effort-nogginlessdom
Ecosystem: npm
Downloads: 927
- 0CriticalAffects 0 versions
- 1HighAffects 1 version
- 0MediumAffects 0 versions
- 1ModerateAffects 1 version
- 0LowAffects 0 versions
Monthly breakdown
- 2 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 1
- Low: 0
Vulnerabilities (2)
Known vulnerabilities affecting asymmetric-effort-nogginlessdom, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-322x-v876-g883 | High | @asymmetric-effort/nogginlessdom's Path Traversal in matchFileSnapshot allows arbitrary file write## Summary The `matchFileSnapshot` function in `src/assertions/snapshots.ts` accepted a `filePath` parameter with zero validation. When snapshot update mode was active (`UPDATE_SNAPSHOTS=1` or `setUpdateMode('all')`), an attacker who controls test input could write arbitrary content to any filesystem path the process has write access to, including creating intermediate directories. ## Affected Code **File:** `src/assertions/snapshots.ts`, lines 732-769 ```typescript export function matchFileSnapshot(actual: unknown, filePath: string): void { const serialized = serialize(actual); const |
| GitHub (opens in a new tab) | |
| GHSA-x4hg-hfwf-p9mw | Moderate | @asymmetric-effort/nogginlessdom vulnerable to ReDoS via user-controlled regex in HTMLInputElement pattern validation## Summary The `HTMLInputElement.checkValidity()` method constructed a `RegExp` directly from the user-controlled `pattern` property without any sanitization or timeout protection. This allowed an attacker to inject a regex with catastrophic backtracking, freezing the event loop. ## Fix Fixed in commit https://github.com/asymmetric-effort/NogginLessDom/commit/25a3cbac665fae5663f8b71c073b80c3152dbe7b on `main`. Added: - Pattern length limit (1024 characters) - Nested quantifier detection (`hasNestedQuantifiers`) that rejects patterns like `(a+)+` before constructing the regex - Patterns exce |
| GitHub (opens in a new tab) |
- GHSA-322x-v876-g883High@asymmetric-effort/nogginlessdom's Path Traversal in matchFileSnapshot allows arbitrary file write
< 0.0.22
## Summary The `matchFileSnapshot` function in `src/assertions/snapshots.ts` accepted a `filePath` parameter with zero validation. When snapshot update mode was active (`UPDATE_SNAPSHOTS=1` or `setUpdateMode('all')`), an attacker who controls test input could write arbitrary content to any filesystem path the process has write access to, including creating intermediate directories. ## Affected Code **File:** `src/assertions/snapshots.ts`, lines 732-769 ```typescript export function matchFileSnapshot(actual: unknown, filePath: string): void { const serialized = serialize(actual); const
- GHSA-x4hg-hfwf-p9mwModerate@asymmetric-effort/nogginlessdom vulnerable to ReDoS via user-controlled regex in HTMLInputElement pattern validation
< 0.0.22
## Summary The `HTMLInputElement.checkValidity()` method constructed a `RegExp` directly from the user-controlled `pattern` property without any sanitization or timeout protection. This allowed an attacker to inject a regex with catastrophic backtracking, freezing the event loop. ## Fix Fixed in commit https://github.com/asymmetric-effort/NogginLessDom/commit/25a3cbac665fae5663f8b71c073b80c3152dbe7b on `main`. Added: - Pattern length limit (1024 characters) - Nested quantifier detection (`hasNestedQuantifiers`) that rejects patterns like `(a+)+` before constructing the regex - Patterns exce