@a2ui/web_core@0.15.0

A2UI Core Library

0.15.0

8 months ago

11 days ago

Known vulnerabilities in the @a2ui/web_core package. This does not include vulnerabilities belonging to this package’s dependencies.

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Vulnerability	Vulnerable Version
M Improper Input Validation @a2ui/web_core is an A2UI Core Library Affected versions of this package are vulnerable to Improper Input Validation via manipulation of the `url` argument in `src/v0_9/basic_catalog/components/Image.js`, used by the Image Player, Video Player, and Audio Player components. An attacker can remotely supply a malicious URL value that bypasses input validation, resulting in limited unauthorized information disclosure. How to fix Improper Input Validation? A fix was pushed into the `master` branch but not yet published.	*
M Denial of Service (DoS) @a2ui/web_core is an A2UI Core Library Affected versions of this package are vulnerable to Denial of Service (DoS) in the `updateComponents` function of `basic_functions.ts`. How to fix Denial of Service (DoS)? There is no fixed version for `@a2ui/web_core`.	>=0.9.0
M Information Exposure @a2ui/web_core is an A2UI Core Library Affected versions of this package are vulnerable to Information Exposure via the `Model Processor` process in `model-processor.ts` when manipulating the `current[segment]` argument. How to fix Information Exposure? A fix was pushed into the `master` branch but not yet published.	>=0.8.0