CVE-2020-36649: mholt papaparse
Vulnerability summary
CVE-2020-36649 is a high (CVSS 7.5) vulnerability in mholt papaparse. EPSS estimates a 1.39% chance of exploitation in the next 30 days, higher than 71.8% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 11-01-2023PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A vulnerability was found in mholt PapaParse up to 5.1.x. It has been classified as problematic. Affected is an unknown function of the file papaparse.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 5.2.0 is able to address this issue. The name of the patch is 235a12758cd77266d2e98fd715f53536b34ad621. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218004.
CVSS metrics
8 scores · 5 sources · 3 versions- CVE.orgCNA3.5LowCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · NpmEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST2.3LowAV:A/AC:M/Au:S/C:N/I:N/A:P
EPSS trend
Probability
1.39%
Chance of exploitation in the next 30 days
Percentile
72%
Versus all other CVEs
30-day change
0.00 pp
From 1.39% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundPapaparse
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Debian1 product
- mediawiki< 1:1.39.4-1~deb12u1 | < 1:1.39.4-1
Mholt1 product
- papaparse5.0 | 5.1
Npm1 product
- papaparse< 5.2.0
Papaparse1 product
- papaparse≥ 5.1.0, < 5.2.0
Ubuntu1 product
- mediawikiAll versions (No fix recorded)
5 vendors · 5 products
References
13 links- github.com/mholt/PapaParse/commit/235a12758cd77266d2e98fd715f53536b34ad621PatchREPORTWEBThird Party Advisory
Show all 13 references
- github.com/mholt/PapaParsePACKAGE