Homepage
About Snyk

kurwov@3.2.4 vulnerabilities

The fastest Markov Chain library for JavaScript

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the kurwov package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Improper Input Validation

kurwov is an a markov chain library

Affected versions of this package are vulnerable to Improper Input Validation due to improper data sanitization in the MarkovData#getNext method used in Markov#generate and Markov#choose. A maliciously crafted string in the dataset can cause the function to throw an error and stop running properly by exploiting the sanitization bypass when a forbidden substring followed by a space character is encountered. This leads to the data being defined as a special function found in its prototype instead of an array, and when data is indexed by a random number, it is supposed to return a string but returns undefined as it's a function, causing the endsWith call to throw.

How to fix Improper Input Validation?

Upgrade kurwov to version 3.2.5 or higher.

>=3.1.0 <3.2.5
Go back to all versions of this package