1vulnerability
- Critical0 (0.0%)
- High1 (100.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
logtape-syslog
Ecosystem: npm
Downloads: 16.16 K
- 0CriticalAffects 0 versions
- 1HighAffects 3 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting logtape-syslog, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-8h6h-x5pq-56fq | High | @logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys`@logtape/syslog` contains two related output-encoding bugs in the structured data formatting code. Both only affect deployments with `includeStructuredData: true`, which is non-default. ## 1. Unescaped C0 control characters in structured data values `escapeStructuredDataValue()` in `packages/syslog/src/syslog.ts` escapes `\`, `"`, and `]` per RFC 5424 but does not escape newline (`\n`), carriage return (`\r`), or any other C0 control characters (U+0000–U+001F): ```typescript function escapeStructuredDataValue(value: string): string { return value .replace(/\\/g, "\\\\") .replace( |
| GitHub (opens in a new tab) |
- GHSA-8h6h-x5pq-56fqHigh@logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys
>= 2.1.0, < 2.1.5>= 2.0.0, < 2.0.14- +1 more
Affected versions:>= 2.1.0, < 2.1.5>= 2.0.0, < 2.0.14< 1.3.11
`@logtape/syslog` contains two related output-encoding bugs in the structured data formatting code. Both only affect deployments with `includeStructuredData: true`, which is non-default. ## 1. Unescaped C0 control characters in structured data values `escapeStructuredDataValue()` in `packages/syslog/src/syslog.ts` escapes `\`, `"`, and `]` per RFC 5424 but does not escape newline (`\n`), carriage return (`\r`), or any other C0 control characters (U+0000–U+001F): ```typescript function escapeStructuredDataValue(value: string): string { return value .replace(/\\/g, "\\\\") .replace(
CVE: CVE-2026-54511