Skip to content

Fix for DoS vulnerability GHSA-wgc6-9f6w-h8hx #15

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

anurag06
Copy link

This PR fixes a denial-of-service vulnerability by adding a character limit to the text processed by microlight.js.

@Qix-
Copy link

Qix- commented Jun 18, 2025

Please don't merge this.

This is 1) a degredation of functionality, 2) improperly formatted, and 3) completely wrong.

I even wonder if @asvd was even notified of anything remotely related to this CVE before it was filed. If not, then whomever filed it should be fired from their job if it was done on behalf of a security company.

In an effort to fight back against the mockery that has become the CVE system I've filed a correction to this CVE here: github/advisory-database#5730

If the author of this CVE is reading, please do better in the future.

@Qix-
Copy link

Qix- commented Jun 18, 2025

Also why is one faceless user the author of the commit but another similarly named faceless user the author of the PR? What is happening here? It reeks of fraud.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants