nadesiko3 allows remote attacker to inject invalid value to decodeURIComponent of nako3edit

Description

Nako3edit is the editor component of Nadeshiko 3, a programming language developed based on Japanese. Improper check or handling of exceptional conditions in Nako3edit v3.3.74 and earlier allows a remote attacker to inject an invalid value to decodeURIComponent of nako3edit, which may lead the server to crash.

Recommendation

Update the nadesiko3 package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.3.75
• Patched version(s): 3.3.75

References

• GHSA-x2jx-w3wm-9p3p
• jvn.jp
• CVE-2022-41777
• CWE-703
• CWE-755
• CAPEC-310
• OWASP 2021-A6

Related Issues

• jsrsasign: Division by Zero Allows Invalid JWK Modulus to Cause Deterministic Zero Output in RSA Operations - CVE-2026-4603
• FUXA allows Remote Code Execution (RCE) via the project import functionality. - CVE-2025-69983
• JSONPath Plus allows Remote Code Execution - CVE-2025-1302
• Invalid file request can crash server - CVE-2022-31089

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

nadesiko3