{"id":"GHSA-mf6x-7mm4-x2g7","summary":"Out-of-bounds Read in stringstream","details":"All versions of `stringstream` are vulnerable to out-of-bounds read as it allocates uninitialized Buffers when number is passed in input stream on Node.js 4.x and below.\n\n\n## Recommendation\n\nNo fix is currently available for this vulnerability. It is our recommendation to not install or use this module if user input is being passed in to `stringstream`.","aliases":["CVE-2018-21270"],"modified":"2023-11-01T04:49:24.465248Z","published":"2019-06-20T18:22:32Z","database_specific":{"cwe_ids":["CWE-125"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2019-06-20T18:22:00Z","nvd_published_at":"2020-12-03T21:15:00Z"},"references":[{"type":"WEB","url":"https://hackerone.com/reports/321670"},{"type":"WEB","url":"https://github.com/mhart/StringStream/blob/v0.0.5/stringstream.js#L32"},{"type":"WEB","url":"https://www.npmjs.com/advisories/664"}],"affected":[{"package":{"name":"stringstream","ecosystem":"npm","purl":"pkg:npm/stringstream"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-mf6x-7mm4-x2g7/GHSA-mf6x-7mm4-x2g7.json"}}],"schema_version":"1.9.0"}