CVE-2025-5896

Katalog CVE

CVSS 7.5 · High EPSS 0,62%

Kerentanan Uncontrolled Resource Consumption pada taro. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability was found in tarojs taro up to 4.1.1. It has been declared as problematic. This vulnerability affects unknown code of the file taro/packages/css-to-react-native/src/index.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely. Upgrading to version 4.1.2 is able to address this issue. The name of the patch is c2e321a8b6fc873427c466c69f41ed0b5e8814bf. It is recommended to upgrade the affected component.

Rincian

Terbit di NVD

9 Juni 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-1333: Inefficient Regular Expression Complexity

EPSS (30 hari)

0,62% peluang dieksploitasi; lebih tinggi dari 48,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/NervJS/taro/commit/c2e321a8b6fc873427c466c69f41ed0b5e8814bf patch
• https://github.com/NervJS/taro/pull/17619 exploit · issue tracking · patch
• https://vuldb.com/?id.311668 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.585796 advisory pihak ketiga · vdb entry
• https://github.com/NervJS/taro/releases/tag/v4.1.2 release notes
• https://vuldb.com/?ctiid.311668 permissions required · vdb entry