CVE-2021-39131CWE-241

Improper Handling of Unexpected Data Type in ced

High · published August 17, 2021

CVSS v3.1
7.5
EPSS
2%
Percentile
79.4
In the wild
Unconfirmed
What it is

ced detects character encoding using Google’s compact_enc_det library. In ced v0.1.0, passing data types other than `Buffer` causes the Node.js process to crash. The problem has been patched in ced v1.0.0. As a workaround, before passing an argument to ced, verify it’s a `Buffer` using `Buffer.isBuffer(obj)`.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01891 · 79.4th percentile
Weakness
CWE-241 · Improper Handling of Unexpected Data Type
Published
2021-08-17T19:55Z
EPSS history
Timeline
  • 17 AUG 19:55Z
    Improper Handling of Unexpected Data Type in ced
    cvelistv5