Executive brief
kurwov is a JavaScript library used for Markov chain text generation. A flaw in how the library sanitizes input data allows an attacker to inject malicious strings that cause the generation functions to crash and become unavailable, disrupting any application that depends on the library for text generation or data processing.
Technical details
This vulnerability is a failure in input validation (CWE-20) affecting the MarkovData#getNext method. When processing dataset contents, the library attempts to sanitize forbidden substrings like "__proto__"; however, an attacker can bypass this sanitization by appending a space character to the forbidden substring. This causes the code to inadvertently access prototype properties instead of data arrays, resulting in a function being assigned where an array is expected. Subsequent array indexing and method calls (endsWith) then fail and throw an exception. The vulnerability is triggered locally when a crafted dataset is loaded into the Markov#generate or Markov#choose methods. No authentication or remote network access is required—only the ability to supply malicious dataset content. An attacker can poison a dataset to cause denial of service. A patch is available in version 3.2.5.
Affected products
- kurwov kurwov 3.1.0 to <3.2.5
Timeline
- 2024-05-03: disclosed
- 2024-05-03: patched: Fixed in version 3.2.5