PT-2025-5755 · Unknown · @Zag-Js/Core

CVE-2024-57079

·

Publicado

2025-02-05

·

Atualizado

2025-02-06

CVSS v3.1

7.5

Alta

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions: @zag-js/core version 0.50.0
Description: A prototype pollution issue in the lib.deepMerge function allows attackers to cause a Denial of Service (DoS) by supplying a crafted payload.
Recommendations: For @zag-js/core version 0.50.0, consider disabling the lib.deepMerge function as a temporary workaround until a patch is available.

Correção

DoS

Prototype Pollution

Resource Exhaustion

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-1321CWE-400

Identificadores relacionados

CVE-2024-57079
GHSA-FG4M-W35Q-VFG2

Produtos afetados

@Zag-Js/Core