{"id":"CVE-2024-34075","aliases":["GHSA-hfrv-h3q8-9jpr"],"url":"https://o3.security/vulnerability/CVE-2024-34075","summary":"kurwov vulnerable to Denial of Service due to improper data sanitization","details":"### Summary\nAn unsafe sanitization of dataset contents on the `MarkovData#getNext` method used in `Markov#generate` and `Markov#choose` allows a maliciously crafted string on the dataset to throw and stop the function from running properly.\n\n### Details\nhttps://github.com/xiboon/kurwov/blob/0d58dfa42135ab40e830e92622857282f980ca89/src/MarkovData.ts#L38-L44\n\nIf a string contains a forbidden substring (i.e. `__proto__`) followed by a space character, the second line will access a special property in `MarkovData#finalData` by removing the last character of the string, bypassing the dataset sanitization (as it is supposed to be already sanitized before this function is called).\n\n`data` is then defined as the special function found in its prototype instead of an array.\n\nOn the last line, `data` is then indexed by a random number, which is supposed to return a string but returns undefined as it's a function. Calling `endsWith` then throws.\n\n### PoC\nhttps://runkit.com/embed/m6uu40r5ja9b\n\n### Impact\nAny dataset can be contaminated with the substring making it unable to properly generate anything in some cases.","published":"2024-05-03T17:51:30.966Z","modified":"2026-08-12T03:51:47.223028516Z","cvss":{"score":6.2,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"kurwov","fixedVersion":"3.2.5"}],"fix":{"url":"https://github.com/xiboon/kurwov/commit/85d63e652594f121d6656177d7a3c0d823c976c9","label":"xiboon/kurwov@85d63e6"},"references":[{"type":"WEB","url":"https://github.com/xiboon/kurwov/blob/0d58dfa42135ab40e830e92622857282f980ca89/src/MarkovData.ts#L38-L44"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34075.json"},{"type":"ADVISORY","url":"https://github.com/xiboon/kurwov/security/advisories/GHSA-hfrv-h3q8-9jpr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34075"},{"type":"FIX","url":"https://github.com/xiboon/kurwov/commit/85d63e652594f121d6656177d7a3c0d823c976c9"},{"type":"PACKAGE","url":"https://github.com/xiboon/kurwov"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:47.223028516Z"}}