Skip to content

Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js

Critical severity GitHub Reviewed Published Oct 24, 2017 to the GitHub Advisory Database • Updated Apr 12, 2023

Package

bundler uglifier (RubyGems)

Affected versions

< 2.7.2

Patched versions

2.7.2
npm uglify-js (npm)
< 2.4.24
2.4.24
Published by the National Vulnerability Database Jan 23, 2017
Published to the GitHub Advisory Database Oct 24, 2017
Reviewed Jun 16, 2020
Last updated Apr 12, 2023

Severity

Critical
9.8
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE ID

CVE-2015-8857

GHSA ID

GHSA-34r7-q49f-h37c

Source code

Checking history
See something to contribute? Suggest improvements for this vulnerability.