CVE-2024-21524

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

All versions of the package node-stringbuilder are vulnerable to Out-of-bounds Read due to incorrect memory length calculation, by calling ToBuffer, ToString, or CharAt on a StringBuilder object with a non-empty string value input. It's possible to return previously allocated memory, for example, by providing negative indexes, leading to an Information Disclosure.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published
Jul 10, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-215258.3All versions of the package node-twain are vulnerable to Improper Check or Handling of Exceptional Conditions due to the length of the sourcCVE-2024-215267.5All versions of the package speaker are vulnerable to Denial of Service (DoS) when providing unexpected input types to the channels propertyCVE-2024-215278.2Versions of the package github.com/gotenberg/gotenberg/v8/pkg/gotenberg before 8.1.0; versions of the package github.com/gotenberg/gotenbergCVE-2024-215285.9All versions of the package node-gettext are vulnerable to Prototype Pollution via the addTranslations() function in gettext.js due to improCVE-2024-215298.2Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. CVE-2024-21539.8A vulnerability, which was classified as critical, was found in SourceCodester Online Mobile Management Store 1.0. This affects an unknown pCVE-2024-215304.5Versions of the package cocoon before 0.4.0 are vulnerable to Reusing a Nonce, Key Pair in Encryption when the encrypt, wrap, and dump functCVE-2024-215315.3All versions of the package git-shallow-clone are vulnerable to Command injection due to missing sanitization or mitigation flags in the proCVE-2024-215327.3All versions of the package ggit are vulnerable to Command Injection via the fetchTags(branch) API, which allows user input to specify the bCVE-2024-215336.5All versions of the package ggit are vulnerable to Arbitrary Argument Injection via the clone() API, which allows specifying the remote URL CVE-2024-215349.8All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can CVE-2024-215356.1Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to Cross-site Scripting (XSS) via the src property due to improper input