brockpetrie/vue-moment · Security
Outdated Static Dependency in vue-moment
- GHSA ID
- GHSA-hrpp-f84w-xhfg
- Severity
- medium
- Published
- Updated
- CVSS
- 5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- CVSS v3
- 5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Description
Versions of vue-moment prior to 4.1.0 contain an Outdated Static Dependency. The package depends on moment and has it loaded statically instead of as a dependency that can be updated. It has [email protected] that contains a Regular Expression Denial of Service vulnerability.
Recommendation
Upgrade to version 4.1.0 or later.
CWEs
- CWE-1104 · Use of Unmaintained Third Party Components