[thi.ng/egf] Potential arbitrary code execution of `#gpg`-tagged property values
- Severity:
- Medium
Description
Potential for arbitrary code execution in #gpg-tagged property values (only if decrypt: true option is enabled)
Recommendation
Update the @thi.ng/egf package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.4.0
- Patched version(s): 0.4.0
References
Related Issues
- Regular Expression Denial of Service (ReDoS) in lodash (GHSA-x5rq-j2xg-h7qm) 3 - CVE-2019-1010266
- Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query - CVE-2025-31125
- Prototype pollution vulnerability found in Mermaid's bundled version of DOMPurify - Vulnerability
- thlorenz browserify-shim vulnerable to prototype pollution (GHSA-r737-347m-wqc7) - CVE-2022-37621
- Tags:
- npm
- @thi.ng/egf
Anything's wrong? Let us know Last updated on February 01, 2023