nodejs / nodejs/nodejs-dependency-vuln-assessments
Whether V8: CVE-2024-7535 has impact on the use of nodejs ？
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 22
- Forks
- 7
- PR merge metrics
- No merged PRs in 30d
Description
Hi colleague,
In recent BDBA scan, there is one CVE:
https://nvd.nist.gov/vuln/detail/CVE-2024-7535
detected in node.js.
According to the description of above, it was detected in V8 in Google Chrome. Here we would like to further confirm whether it is true positive in node.js or not.
Additional information
Inappropriate implementation in V8 in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Best regards,
Peilin
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the NVD entry for CVE-2024-7535 and compare its stated V8 and Chrome conditions with the Node.js versions and V8 dependency information relevant to this repository. Done means documenting whether the CVE affects Node.js use and explaining the basis for that conclusion.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100