Exposure of Sensitive Information to an Unauthorized Actor in nanoid
The package nanoid from 3.0.0, before 3.1.31, are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-23566US | medium5.5 | — | ||
The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated. | ||||
02
references
External citations — patches, advisories, analysis.
- https://gist.github.com/artalar/bc6d1eb9a3477d15d2772e876169a444WEB
- https://github.com/ai/nanoidPACKAGE
- https://github.com/ai/nanoid/commit/2b7bd9332bc49b6330c7ddb08e5c661833db2575WEB
- https://github.com/ai/nanoid/pull/328WEB
- https://lists.debian.org/debian-lts-announce/2024/12/msg00025.htmlWEB
- https://lists.debian.org/debian-lts-announce/2025/01/msg00006.htmlWEB
- https://nvd.nist.gov/vuln/detail/CVE-2021-23566ADVISORY
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2332550WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan