CVE-2024-34075 json
kurwov vulnerable to Denial of Service due to improper data sanitization
published 2024-05-03 2 y ago modified 2026-09-10 1 mo ago also GHSA-hfrv-h3q8-9jpr , EUVD-2024-1647
- cvss
- 6.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 22%
- public exploits
- 0
- none known
Summary
kurwov is a fast, dependency-free library for creating Markov Chains. An unsafe sanitization of dataset contents on the `MarkovData#getNext` method used in `Markov#generate` and `Markov#choose` allows a maliciously crafted string on the dataset to throw and stop the function from running properly. If a string contains a forbidden substring (i.e. `__proto__`) followed by a space character, the code will access a special property in `MarkovData#finalData` by removing the last character of the string, bypassing the dataset sanitization (as it is supposed to be already sanitized before this function is called). Any dataset can be contaminated with the substring making it unable to properly generate anything in some cases. This issue has been addressed in version 3.2.5 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.30% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.2 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 6.2 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | kurwov | >=3.1.0, <3.2.5 |
3.2.5 |
Affected products
- xiboon kurwov
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
github.com
/xiboon/kurwov/commit/85d63e652594f121d6656177d7a3c0d823c976c9
web
-
github.com
/xiboon/kurwov/security/advisories/GHSA-hfrv-h3q8-9jpr
web
-
github.com
/xiboon/kurwov/blob/0d58dfa42135ab40e830e92622857282f980ca89/src/MarkovData.ts#L38-L44
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-34075
advisory
-
github.com
/xiboon/kurwov
package
Sources
- CVE List CVE-2024-34075
- GitHub Advisory GHSA-hfrv-h3q8-9jpr
- NVD CVE-2024-34075
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.