What is GHSA-65p8-3hm4-h9h8?

GHSA-65p8-3hm4-h9h8 is a security advisory published by GitHub Security Advisories with Medium severity. Denial of Service in rgb2hex

Why does GHSA-65p8-3hm4-h9h8 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-65p8-3hm4-h9h8?

GHSA-65p8-3hm4-h9h8 has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-65p8-3hm4-h9h8?

GHSA-65p8-3hm4-h9h8 affects 1 product, including: npm/rgb2hex:\u003c 0.1.6.

GHSA-65p8-3hm4-h9h8MediumCVSS 6.5Disclosed before NVD

Denial of Service in rgb2hex

Vendor

GitHub Security Advisories

Published

August 23, 2019

Last Modified

January 9, 2023

📋 Description

All versions of rgb2hex are vulnerable to Regular Expression Denial of Service (ReDoS) when an attacker can pass in a specially crafted invalid color value.

Recommendation

Update to version 0.1.6 or later.

🎯 Affected products1

npm/rgb2hex:< 0.1.6

🔗 References (5)

https://hackerone.com/reports/319629
https://github.com/christian-bromann/rgb2hex/blob/v0.1.0/index.js#L25
https://www.npmjs.com/advisories/647
https://snyk.io/vuln/npm:rgb2hex:20180429
https://github.com/advisories/GHSA-65p8-3hm4-h9h8