Javascript — CraftedSignal Threat Feed

xmldom Uncontrolled Recursion DoS Vulnerability

hello@craftedsignal.io — Thu, 23 Apr 2026 12:00:00 +0000

The xmldom library is susceptible to a denial-of-service (DoS) vulnerability due to uncontrolled recursion in XML serialization. Seven recursive traversals within lib/dom.js lack depth limits, causing a RangeError: Maximum call stack size exceeded and crashing the application when processing deeply nested XML documents. Publicly disclosed on 2026-04-06, the vulnerability impacts multiple functions, including normalize(), XMLSerializer.serializeToString(), and others related to DOM manipulation. This issue arises from the library’s pure-JavaScript recursive implementation of DOM operations, which exhausts the call stack. Exploitation requires no authentication or special options, affecting applications that process attacker-controlled XML using vulnerable xmldom versions ( < 0.8.13, >= 0.9.0 and < 0.9.10, and <= 0.6.0).

Attack Chain

An attacker crafts a malicious XML document with deeply nested elements.
The vulnerable application receives and parses the crafted XML document using DOMParser.parseFromString().
The application subsequently calls one of the affected DOM operations, such as normalize(), serializeToString(), getElementsByTagName(), or cloneNode(true).
The affected function initiates a recursive traversal of the deeply nested XML structure within lib/dom.js.
Each level of nesting consumes a JavaScript call stack frame.
The recursive calls continue until the JavaScript engine’s call stack is exhausted.
A RangeError: Maximum call stack size exceeded exception is thrown.
The application crashes due to the uncaught exception, leading to a denial of service.

Impact

Successful exploitation results in a denial-of-service condition. Any service parsing attacker-controlled XML with a vulnerable version of xmldom can be crashed by a single crafted payload. This can lead to failed request processing. In deployments where uncaught exceptions terminate the worker or process, the impact can extend beyond a single request and disrupt service availability more broadly. Tests show that stack exhaustion occurs with nesting depths between 5,000 and 10,000 levels depending on the operation.

Recommendation

Upgrade @xmldom/xmldom to version >= 0.8.13 or >= 0.9.10 to remediate CVE-2026-41673.
If upgrading is not immediately feasible, consider implementing input validation to limit the nesting depth of XML documents processed by applications using xmldom.
Monitor application logs for RangeError: Maximum call stack size exceeded exceptions originating from lib/dom.js, which could indicate exploitation attempts.

brikcss merge Prototype Pollution Vulnerability (CVE-2026-6594)

hello@craftedsignal.io — Mon, 20 Apr 2026 02:16:15 +0000

A prototype pollution vulnerability, identified as CVE-2026-6594, affects brikcss merge versions up to 1.3.0. This vulnerability allows a remote attacker to manipulate the proto/constructor.prototype/prototype argument, leading to the modification of object prototype attributes. The vendor was notified, but did not respond. Successful exploitation can lead to denial of service, code injection, or other unintended behaviors in applications using the affected library. Prototype pollution vulnerabilities are particularly concerning as they can have widespread effects, potentially impacting multiple parts of an application or even other applications sharing the same JavaScript runtime.

Attack Chain

Attacker identifies a vulnerable endpoint in an application using brikcss merge <= 1.3.0.
The attacker crafts a malicious payload containing a __proto__, constructor.prototype, or prototype property.
The malicious payload is sent to the vulnerable endpoint, often as part of a JSON object within a POST request.
The brikcss merge function processes the payload without proper sanitization or input validation.
The __proto__ property is used to modify the prototype of JavaScript objects.
The prototype modification injects malicious properties or methods into all objects inheriting from the modified prototype.
The application executes code that relies on the now-polluted prototype.
This leads to unexpected behavior, such as arbitrary code execution, denial-of-service, or information disclosure.

Impact

Successful exploitation of CVE-2026-6594 can lead to a variety of impacts, including denial of service, arbitrary code execution, and information disclosure. Since the vulnerability allows for modification of object prototypes, the impact can be widespread, affecting multiple parts of an application and potentially other applications. The number of affected applications is currently unknown, but any application using a vulnerable version of brikcss merge is potentially at risk.

Recommendation

Upgrade brikcss merge to a patched version or remove the library entirely from your project to remediate CVE-2026-6594.
Deploy the Sigma rule “Detect Prototype Pollution via HTTP Request” to detect exploitation attempts targeting web applications that use brikcss merge.
Implement input validation and sanitization on all user-supplied data processed by brikcss merge to prevent malicious payloads from being processed.
Review and audit code that uses brikcss merge to identify potential vulnerable code paths.
Monitor web server logs for requests containing __proto__, constructor.prototype, or prototype parameters in the request body as described in the attack chain.

Axios NPM Supply Chain Attack Delivering Platform-Specific RATs

hello@craftedsignal.io — Sat, 04 Apr 2026 12:00:00 +0000

On March 31, 2026, the official Axios node package manager (npm) package was compromised in a supply chain attack. The attack resulted in the deployment of two malicious versions, v1.14.1 and v0.30.4. Axios is a widely-used JavaScript library for making HTTP requests, with approximately 100 million downloads per week. The malicious packages were available for around three hours. The compromised packages introduced a fake runtime dependency, ‘plain-crypto-js’, that executes automatically after installation. This dependency then communicates with attacker-controlled infrastructure at 142.11.206.73, pulling down platform-specific payloads for Linux, MacOS, and Windows. The payloads are remote access trojans (RATs), enabling the attackers to gather information and execute additional malicious activities.

Attack Chain

The attacker compromised the Axios NPM package and injected malicious code.
Malicious versions v1.14.1 and v0.30.4 were published to the NPM registry.
The malicious packages introduce a fake runtime dependency named ‘plain-crypto-js’.
Upon installation of the compromised package, the ‘plain-crypto-js’ dependency executes automatically via a post-install script.
The dependency connects to the attacker-controlled IP address 142.11.206.73 to retrieve a platform-specific payload.
On MacOS, a binary named “com.apple.act.mond” is downloaded and executed using zsh.
On Windows, a PowerShell script (6202033.ps1) is downloaded, and the legitimate powershell.exe is copied to “%PROGRAM DATA%\wt.exe”, and the ps1 script is executed with hidden and execution policy bypass flags.
On Linux, a Python backdoor is downloaded and executed. The downloaded executables act as Remote Access Trojans (RATs) exfiltrating credentials and enabling remote management.

Impact

This supply chain attack could lead to significant compromise across numerous organizations using the Axios library. The actors exfiltrate credentials and gain remote management capabilities. All credentials present on systems that installed the malicious package should be considered compromised and immediately rotated. The widespread use of Axios means the impact could extend to many applications and systems, potentially enabling further attacks leveraging compromised credentials. Supply chain attacks like these affecting widely used libraries, as seen in 25% of the top 100 vulnerabilities in the Cisco Talos 2025 Year in Review, highlight the substantial risk they pose.

Recommendation

Roll back to safe Axios versions (v1.14.0 or v0.30.3) immediately to prevent further compromise, as mentioned in the overview.
Investigate systems that downloaded malicious packages (v1.14.1 or v0.30.4) for signs of follow-on payloads from the actor-controlled infrastructure, as described in the overview.
Block the actor-controlled IP address 142.11.206.73 and domain Sfrclak.com at the network perimeter to prevent further communication with the malicious infrastructure, per the IOC list.
Monitor for execution of PowerShell scripts from unusual locations, specifically “%PROGRAM DATA%\wt.exe”, as part of the attack chain.
Implement a process creation rule to alert when processes connect to external IPs using uncommon parent processes. See example rule below.

Electron VideoFrame Context Isolation Bypass Vulnerability (CVE-2026-34780)

hello@craftedsignal.io — Sat, 04 Apr 2026 01:16:39 +0000

Electron, a framework for building cross-platform desktop applications using web technologies, is vulnerable to a context isolation bypass (CVE-2026-34780) when handling VideoFrame objects. This vulnerability affects Electron versions 39.0.0-alpha.1 to before 39.8.0, 40.0.0-alpha.1 to before 40.7.0, and 41.0.0-alpha.1 to before 41.0.0-beta.8. Specifically, applications are at risk if they utilize contextBridge.exposeInMainWorld() to pass a VideoFrame object from a preload script to the main world. An attacker who achieves JavaScript execution in the main world, for example, through a cross-site scripting (XSS) vulnerability, can leverage a bridged VideoFrame to bypass context isolation and gain access to the isolated world, including Node.js APIs exposed to the preload script. This access enables further malicious activities, potentially leading to arbitrary code execution on the host system. Patches are available in versions 39.8.0, 40.7.0, and 41.0.0-beta.8.

Attack Chain

The attacker identifies an Electron application using a vulnerable version of Electron (39.0.0-alpha.1 to 39.7.x, 40.0.0-alpha.1 to 40.6.x, or 41.0.0-alpha.1 to 41.0.0-beta.7) that also uses contextBridge.exposeInMainWorld() to expose a VideoFrame object.
The attacker injects malicious JavaScript code into the application’s main world. This can be achieved through various means, such as exploiting a cross-site scripting (XSS) vulnerability.
The injected JavaScript code interacts with the bridged VideoFrame object.
The VideoFrame object, due to the vulnerability, allows the attacker to bypass context isolation and gain access to the isolated world.
The attacker leverages the access to the isolated world to access Node.js APIs that are exposed to the preload script.
The attacker utilizes the exposed Node.js APIs to perform malicious actions, such as reading sensitive data, modifying application settings, or executing arbitrary code on the host system.
The attacker may escalate privileges by exploiting further vulnerabilities or misconfigurations within the application or the underlying operating system.
The final objective is to achieve arbitrary code execution on the host system, allowing the attacker to perform any desired actions.

Impact

Successful exploitation of this vulnerability (CVE-2026-34780) allows an attacker to bypass context isolation in affected Electron applications, potentially leading to arbitrary code execution. The number of victims depends on the popularity and security posture of Electron applications that bridge VideoFrame objects. If the attack succeeds, an attacker could steal sensitive data, install malware, or completely compromise the user’s system. Sectors heavily reliant on Electron-based desktop applications, such as communication, development, and productivity tools, are at higher risk.

Recommendation

Upgrade Electron applications to patched versions (39.8.0, 40.7.0, or 41.0.0-beta.8) to address CVE-2026-34780.
Review and sanitize all user-supplied input to prevent XSS vulnerabilities that can be leveraged to exploit CVE-2026-34780.
Implement strict Content Security Policy (CSP) to mitigate the risk of XSS attacks.
Monitor application logs for suspicious JavaScript execution, especially related to VideoFrame objects and contextBridge.exposeInMainWorld(), to detect potential exploitation attempts.
Deploy the Sigma rule for suspicious process execution via Node.js APIs to detect malicious behavior following a successful context isolation bypass.

SandboxJS Integrity Escape Vulnerability

hello@craftedsignal.io — Fri, 03 Apr 2026 21:44:39 +0000

A critical vulnerability exists in SandboxJS versions prior to 0.8.36, a JavaScript sandbox library. This vulnerability allows malicious or untrusted JavaScript code executed within the sandbox to escape the sandbox and modify global objects in the host environment. The bypass is achieved through an exposed callable constructor path: this.constructor.call(target, attackerObject), allowing attackers to circumvent intended protections against direct assignment to global objects. This can lead to persistent modifications of host runtime state and cross-context contamination. Successful exploitation could allow attackers to compromise other requests, tenants, or subsequent sandbox runs within the same process, potentially leading to control-flow hijack in application logic that assumes trusted built-in behavior.

Attack Chain

The attacker injects JavaScript code into the SandboxJS environment.
The injected code gains access to the SandboxGlobal constructor via this.constructor.
The attacker leverages Function.prototype.call to invoke the SandboxGlobal constructor with a target global object (e.g., Math, JSON) and a payload object containing properties to overwrite.
The SandboxGlobal constructor copies properties from the attacker-controlled payload object into the specified global object in the host environment, bypassing the intended write-time checks.
The host environment’s global object is modified with attacker-supplied values.
Subsequent executions of SandboxJS instances within the same process now operate with the tainted global object.
If the host application relies on the integrity of the mutated global objects, attacker can hijack control flow.
The attacker achieves code execution in the host environment due to the modified global state.

Impact

This vulnerability allows untrusted code to escape the SandboxJS sandbox and directly manipulate the host environment’s global objects. This can lead to a variety of impacts, including persistent cross-context contamination, where new sandbox instances are initialized with a tainted state. The modification of critical global objects can lead to unpredictable behavior and, in certain scenarios, enable complete control-flow hijack of the host application. The severity of the impact is considered critical due to the potential for widespread and persistent compromise. Affected versions: npm/@nyariv/sandboxjs (vulnerable: < 0.8.36).

Recommendation

Upgrade to SandboxJS version 0.8.36 or later to patch the vulnerability (Affected Packages).
Implement monitoring for unexpected modifications to global objects within the host environment where SandboxJS is deployed (see rule “Detect SandboxJS Global Object Mutation via Constructor Call”).
Consider implementing additional layers of defense, such as restricting the capabilities of the host environment where SandboxJS is running, to minimize the impact of a successful sandbox escape (see rule “Detect SandboxJS Constructor Call to Global Objects”).
Review host application code that relies on global objects and consider implementing validation checks to ensure their integrity (see CVE-2026-34208).

Axios npm Package Compromised in Supply Chain Attack

hello@craftedsignal.io — Tue, 31 Mar 2026 21:04:21 +0000

On March 31, 2026 (UTC), the Axios npm package, a popular JavaScript library for making HTTP/S requests used by millions of applications, was targeted in a supply chain attack. A compromised maintainer account was used to publish malicious versions of the package, specifically axios@1.14.1 and axios@0.30.4, between approximately 00:21 and 03:30 UTC. This incident highlights the risks associated with software supply chains and the potential for attackers to inject malicious code into widely used components, impacting countless downstream applications. Defenders should prioritize monitoring their dependencies and implementing measures to detect and prevent such attacks.

Attack Chain

Compromise Maintainer Account: An attacker gains unauthorized access to the credentials of an Axios npm package maintainer.
Publish Malicious Package Versions: The attacker uses the compromised account to publish malicious versions of the Axios package (axios@1.14.1 and axios@0.30.4) to the npm registry.
Dependency Resolution: Developers or automated build systems unknowingly download and incorporate the malicious Axios versions into their projects during dependency resolution.
Malicious Code Execution: The malicious code within the Axios package executes within the context of the affected applications.
Privilege Escalation (If Applicable): Depending on the vulnerabilities exploited, the attacker may attempt to escalate privileges within the compromised environment.
Data Exfiltration/Lateral Movement: The attacker uses the compromised application as a beachhead to exfiltrate sensitive data or move laterally to other systems on the network.
Establish Persistence: The attacker establishes persistent access to the compromised environment to maintain control.
Achieve Objectives: The attacker achieves their ultimate objectives, which could include data theft, system disruption, or further compromise of the software supply chain.

Impact

This supply chain attack on the Axios npm package has the potential to affect millions of applications that depend on the library. Successful exploitation could lead to data breaches, unauthorized access to systems, and widespread disruption of services. The exact scope of the impact depends on the nature of the malicious code injected into the Axios package and the vulnerabilities it exploits.

Recommendation

Monitor npm package installations for the presence of axios@1.14.1 and axios@0.30.4 and investigate any occurrences (refer to the Overview section).
Implement integrity checks for npm packages to detect unauthorized modifications to dependencies.
Deploy the provided Sigma rule to detect suspicious process execution within applications using the Axios library (see rule: “Detect Suspicious Process Execution from Axios”).

Forge Ed25519 Signature Forgery Vulnerability

hello@craftedsignal.io — Thu, 26 Mar 2026 22:08:55 +0000

The Forge library, a popular JavaScript cryptography toolkit, exhibits a signature forgery vulnerability in its Ed25519 implementation. Specifically, the verification process lacks a critical check to ensure that the scalar ‘S’ is less than the group order ‘L’ (S < L). This omission enables the acceptance of non-canonical signatures, effectively forging signatures. This vulnerability affects Forge versions prior to 1.4.0. An attacker could exploit this flaw to bypass security mechanisms that rely on the uniqueness of cryptographic signatures, such as authentication systems, replay protection, and signed-object canonicalization checks. This is especially critical for applications assuming that valid signatures are unique. The issue was identified in commit 8e1d527fe8ec2670499068db783172d4fb9012e5 and has been present since the introduction of Ed25519 support.

Attack Chain

The attacker identifies an application using Forge’s Ed25519 implementation for signature verification.
The attacker obtains a valid Ed25519 signature for a specific message using a legitimate key pair.
The attacker manipulates the valid signature by adding the Ed25519 group order ‘L’ to the ‘S’ component of the signature (bytes 32-63), creating a non-canonical signature.
The attacker submits the forged, non-canonical signature to the vulnerable application for verification.
The Forge library, due to the missing ‘S < L’ check, incorrectly validates the forged signature as authentic.
The vulnerable application accepts the forged signature, potentially granting unauthorized access or allowing malicious actions.
The attacker successfully bypasses authentication or authorization controls that rely on signature validation.

Impact

Successful exploitation of this vulnerability can lead to a bypass of authentication and authorization mechanisms in applications that rely on Forge’s Ed25519 implementation for signature verification. This could result in unauthorized access to sensitive data, account compromise, or the execution of malicious commands. The number of affected applications is potentially significant, given Forge’s widespread use in JavaScript-based systems. This is further compounded by the vulnerability existing since the initial implementation of Ed25519 in the library. The impact of this vulnerability will vary, depending on how signatures are used within the application. Applications that depend on unique signatures for integrity checks are at significant risk.

Recommendation

Upgrade to Forge version 1.4.0 or later, which includes a fix for CVE-2026-33895 (https://nvd.nist.gov/vuln/detail/CVE-2026-33895).
Apply the provided patch to earlier versions of Forge to enforce strict canonical scalar validation in the Ed25519 verification path.
Deploy the Sigma rule “Detect Forged Ed25519 Signatures via Modified S Value” to identify attempts to exploit this vulnerability.
Audit applications using Forge to identify and remediate any reliance on signature uniqueness for security-critical functions.

Mozilla Firefox and Thunderbird Use-After-Free Vulnerability (CVE-2026-4723)

hello@craftedsignal.io — Tue, 24 Mar 2026 13:16:08 +0000

CVE-2026-4723 is a critical use-after-free vulnerability affecting the JavaScript Engine component in Mozilla Firefox and Thunderbird. This flaw exists in versions prior to 149. A remote attacker could potentially exploit this vulnerability by crafting malicious JavaScript code that, when processed by a vulnerable browser or email client, triggers the use-after-free condition. The vulnerability was reported by Mozilla Corporation and assigned a CVSS v3.1 base score of 9.8, indicating a high…

Jsrsasign Infinite Loop Vulnerability (CVE-2026-4598)

hello@craftedsignal.io — Mon, 23 Mar 2026 06:16:21 +0000

The jsrsasign library, a popular JavaScript library for implementing cryptography standards, is susceptible to a denial-of-service vulnerability. Specifically, versions prior to 11.1.1 are vulnerable to CVE-2026-4598, where the bnModInverse function within ext/jsbn2.js can enter an infinite loop when processing zero or negative inputs to the BigInteger.modInverse function. An attacker can exploit this by providing maliciously crafted values (e.g., modInverse(0, m) or `modInverse(-1…

Denial of Service Vulnerability in marked via Infinite Recursion

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

A critical Denial of Service (DoS) vulnerability has been identified in marked@18.0.0. This vulnerability arises from the processing of a specific 3-byte input sequence: a tab character, a vertical tab character, and a newline character (\x09\x0b\n). An unauthenticated attacker can exploit this by sending this sequence to a Node.js application utilizing the vulnerable version of the marked library. This input triggers an infinite recursion loop within the marked tokenizer during parsing, leading to unbounded memory allocation and ultimately causing the host Node.js application to crash due to Memory Exhaustion (OOM). This vulnerability allows for a total loss of availability for any application using the vulnerable library to process potentially untrusted input.

Attack Chain

The attacker sends a crafted input string containing the sequence \x09\x0b\n to a Node.js application using marked@18.0.0.
The space() tokenizer in marked consumes the initial tab character (\x09) using the regex /^(?:[ \t]*(?:\n|$))+/.
The newline block rule fails to match the remaining \x0b\n sequence because the vertical tab is not accounted for in the rule [ \t].
The parser falls through to the text tokenizer (/^[^\n]+/), which matches the \x0b\n sequence.
Inside the blockTokens() function, the text tokenizer creates a text token.
The blockTokens() function then calls inlineTokens() on the same input (\x0b\n).
The inlineTokens() function’s text rule matches \x0b\n and recursively calls inlineTokens() again, leading to an infinite loop.
Each recursive call allocates new token objects and concatenates strings, causing memory usage to grow until the Node.js heap limit is reached, resulting in a crash.

Impact

This vulnerability results in a High-Severity Denial of Service (DoS) via Memory Exhaustion. Any application, API, chatbot, or documentation system using marked@18.0.0 to parse untrusted user input is vulnerable. The attack requires minimal resources from the attacker, only the ability to send a 3-byte payload, to cause a total loss of availability. The vulnerability affects npm/marked versions greater than or equal to 18.0.0 and less than or equal to 18.0.1.

Recommendation

Upgrade to a patched version of the marked library that addresses the infinite recursion vulnerability.
Monitor Node.js application logs for error messages indicating memory exhaustion or crashes, which might indicate exploitation attempts.
Implement input validation to sanitize or reject input containing the malicious \x09\x0b\n sequence.
Deploy the Sigma rule for marked process crashes due to memory exhaustion to identify exploitation attempts.

locize Client SDK Cross-Origin DOM XSS and Handler Hijack Vulnerability

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

The locize client SDK, a browser module integrating the locize InContext translation editor, contains a cross-origin vulnerability in versions prior to 4.0.21. The vulnerability stems from the SDK’s failure to validate the event.origin property when handling window.addEventListener("message") events. This allows a malicious webpage sharing a window reference with a locize-enabled host (e.g., via an iframe) to send crafted postMessage calls, triggering internal handlers without proper authorization. Successful exploitation can lead to DOM-based XSS, hijacking of the api.source and api.origin properties, and CSS injection, potentially compromising the confidentiality and integrity of the application. This vulnerability was discovered via an internal security audit of the locize ecosystem.

Attack Chain

An attacker hosts a malicious webpage with the intent to exploit a locize-enabled application.
The locize-enabled application embeds the attacker’s page as an iframe or has a window.opener/window.open relationship with it.
The attacker crafts a postMessage with a sender field equal to "i18next-editor-frame" and a malicious payload targeted at specific handlers.
The locize SDK’s window.addEventListener("message") handler receives the message and, without validating event.origin, dispatches it to the internal handlers.
If the attacker targets the editKey or commitKeys handlers, the attacker-controlled payload values are assigned to item.node.innerHTML or item.node.setAttribute(attr, value), injecting malicious scripts or HTML.
If the attacker targets the isLocizeEnabled handler, the api.source and api.origin are hijacked, redirecting subsequent messages to the attacker’s window and exfiltrating translation content.
If the attacker targets the requestPopupChanges handler, malicious CSS code is injected into the popup’s inline style.
The attacker gains unauthorized access to sensitive data or injects malicious content into the locize-enabled application, impacting its integrity and confidentiality.

Impact

Successful exploitation of this vulnerability can lead to several critical consequences. Cross-origin DOM XSS allows arbitrary code execution within the context of the vulnerable application. Hijacking api.source and api.origin results in the leakage of translation content and metadata to the attacker, compromising sensitive information. CSS injection can alter the visual appearance of the application, potentially leading to phishing attacks or further exploitation. The number of victims depends on the adoption rate of vulnerable locize SDK versions prior to 4.0.21.

Recommendation

Upgrade to locize client SDK version 4.0.21 or later to patch the vulnerability. This version implements event.origin validation in src/api/postMessage.js, mitigating the risk of cross-origin attacks.
Deploy the Sigma rule “Detect Locize Client SDK DOM XSS Attempt via postMessage” to identify exploitation attempts based on manipulation of innerHTML or setAttribute in the locize context.
Enable web server logging and monitor for suspicious postMessage events originating from unexpected domains to detect potential exploitation attempts targeting the locize SDK.