Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.
cvss
7.5
high
CVSS v3.1 base score out of 10
epss
not scored
chance of exploitation in 30 days
xyz score
4.9
medium
CyberXYZ composite out of 10
fig. 01 — GHSA-6chw-6frg-f759, the advisory selected below
// 2 advisories
GHSA-6chw-6frg-f759
HIGHGitHub rating
Affected versions of acorn are vulnerable to Regular Expression Denial of Service. A regex in the form of /[x-\ud800]/u causes the parser to enter an infinite loop. The string is not valid UTF16 which usually results in it being sanitized before reaching the parser. If an application processes untrusted input and passes it directly to acorn, attackers may leverage the vulnerability leading to Denial of Service.
// cvss v3.1 vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Checked 2026-11-06 at 23:02 UTC. The most recent advisory here was published 2020-04-03. Updated continuously from NVD, GHSA, OSV and CNA feeds.