Workflow

PyPi: Mini-Racer

CVE-2024-3156

Transitive

Safety vulnerability ID: 71113

This vulnerability was reviewed by experts

The information on this page was manually curated by our Cybersecurity Intelligence Team.

Created at Apr 06, 2024 Updated at Nov 29, 2024
Scan your Python projects for vulnerabilities →

Advisory

Mini-racer version 0.12.1 updates to V8 12.4, which includes fixes for CVE-2024-3156. This update ensures that the package incorporates the latest security patches and improvements provided by the new version of the V8 engine.

Affected package

mini-racer

Latest version: 0.12.4

Minimal, modern embedded V8 for Python.

Affected versions

Fixed versions

Vulnerability changelog

- Update to V8 12.4. This includes fixes for CVE-2024-3159, CVE-2024-3156, and
CVE-2024-2625. These vulnerabilities in V8 would impact PyMiniRacer users who are
running untrusted and adversarial JavaScript code.

Resources

Use this package?

Scan your Python project for dependency vulnerabilities in two minutes

Scan your application

Severity Details

CVSS Base Score

HIGH 8.8

CVSS v3 Details

HIGH 8.8
Attack Vector (AV)
NETWORK
Attack Complexity (AC)
LOW
Privileges Required (PR)
NONE
User Interaction (UI)
REQUIRED
Scope (S)
UNCHANGED
Confidentiality Impact (C)
HIGH
Integrity Impact (I)
HIGH
Availability Availability (A)
HIGH