kurwov vulnerable to Denial of Service due to improper data sanitization
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-502.
Summary
kurwov is a fast, dependency-free library for creating Markov Chains. An unsafe sanitization of dataset contents on the `MarkovData#getNext` method used in `Markov#generate` and `Markov#choose` allows a maliciously crafted string on the dataset to throw and stop the function from running properly. If a string contains a forbidden substring (i.e. `__proto__`) followed by a space character, the code will access a special property in `MarkovData#finalData` by removing the last character of the string, bypassing the dataset sanitization (as it is supposed to be already sanitized before this function is called). Any dataset can be contaminated with the substring making it unable to properly generate anything in some cases. This issue has been addressed in version 3.2.5 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| xiboon | kurwov | 3.1.0 to before 3.2.5 | 3.2.5 | Patch available | CNA |
| — | kurwov (npm) | 3.1.0 to before 3.2.5 | 3.2.5 | Patch available | GHSA-hfrv-h3q8-9jpr |
- kurwov Vendorxiboon Affected 3.1.0 to before 3.2.5 Fixed in 3.2.5 Patch available CNA
- kurwov (npm) Vendor— Affected 3.1.0 to before 3.2.5 Fixed in 3.2.5 Patch available GHSA-hfrv-h3q8-9jpr
Remediation
- Fix · CNA kurwov (xiboon) Fixed in 3.2.5
- Fix · GHSA-hfrv-h3q8-9jpr kurwov (npm) Fixed in 3.2.5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-34075
- 2026-10-03 Alias added: GHSA-hfrv-h3q8-9jpr
References
Sources
- CVE-2024-34075 · CVE Program
- CVE-2024-34075 · NVD
- FIRST EPSS
- GHSA-hfrv-h3q8-9jpr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences