Executive brief
The transpile library is a JavaScript code transformation tool used by developers to convert modules between different JavaScript formats (ES6, CommonJS, AMD, etc.). The .to() function fails to properly validate inputs, allowing attackers to trigger excessive resource consumption and crash applications that use this library—a denial-of-service vulnerability.
Technical details
The vulnerability is an uncontrolled resource consumption (CWE-400) and improper exception handling (CWE-755) issue in the .to() function of the transpile library. The root cause is insufficient input sanitization or whitelisting combined with poor error handling that allows specially crafted inputs to consume excessive CPU or memory resources. An attacker can trigger a denial-of-service condition by providing malicious input to the transpile.to() function; this attack requires only network access if the library is exposed via an API endpoint, or local access if invoked directly. All versions up to and including 2.7.2 are affected. No patch information is provided in the advisory.
Affected products
- stealjs transpile 0 through 2.7.2
Timeline
- 2021-08-24: disclosed
- 2021-09-02: advisory