Code Monkey home page Code Monkey logo

shaka-player's Introduction

Shaka Player

Shaka Player is an open-source JavaScript library for adaptive media. It plays adaptive media formats (such as DASH and HLS) in a browser, without using plugins or Flash. Instead, Shaka Player uses the open web standards MediaSource Extensions and Encrypted Media Extensions.

Shaka Player also supports offline storage and playback of media using IndexedDB. Content can be stored on any browser. Storage of licenses depends on browser support.

Our main goal is to make it as easy as possible to stream adaptive bitrate video and audio using modern browser technologies. We try to keep the library light, simple, and free from third-party dependencies. Everything you need to build and deploy is in the sources.

For details on what's coming next, see our development roadmap.

Platform and browser support matrix

Browser Windows Mac Linux Android iOS >= 12 ChromeOS Other
Chrome¹ Y Y Y Y Native Y -
Firefox¹ Y Y Y untested⁵ Native - -
Edge¹ Y - - - - - -
IE ≤ 10 N - - - - - -
IE 11 Y - - - - - -
Safari¹ - Y - - iPadOS 13
Native
- -
Opera¹ untested⁵ untested⁵ untested⁵ untested⁵ Native - -
Chromecast² - - - - - - Y
Tizen TV³ - - - - - - Y

NOTES:

  • ¹: On macOS, only Safari 12+ is supported. On iOS, only iOS 12+ is supported. Older versions will be rejected.
  • ²: The latest stable Chromecast firmware is tested. Both sender and receiver can be implemented with Shaka Player.
  • ³: Tizen 2017 model is actively tested and supported by the Shaka Player team. Tizen 2016 model is community-supported and untested by us.
  • ⁴: IE 11 offers PlayReady support on Windows 8.1 and Windows 10 only. IE 11 can play clear content on Windows 8.0. IE 11 does not support adaptive playback on Windows 7 and under. (IE support will stop in v3.1: shaka-project#2339)
  • ⁵: These are expected to work, but are not actively tested by the Shaka Player team.

We support iOS 12+ through Apple's native HLS player. We provide the same top-level API, but we just set the video's src element to the manifest/media. So we are dependent on the browser supporting the manifests.

Shaka Player Embedded (for native iOS)

We have another project called Shaka Player Embedded that offers the same features and similar APIs for native apps on iOS. This project uses its own media stack, which allows it to play content that would otherwise not be supported. This supports both DASH and HLS manifests.

Manifest format support matrix

Format Video On-Demand Live Event In-Progress Recording
DASH Y Y - Y
HLS Y Y Y -

You can also create a manifest parser plugin to support custom manifest formats.

DASH features

DASH features supported:

  • VOD, Live, and In-Progress Recordings (dynamic VOD content)
  • MPD@timeShiftBufferDepth for seeking backward in Live streams
  • Multi-period content (static and dynamic)
  • Xlink elements (actuate=onLoad only, resolve-to-zero, fallback content)
  • All forms of segment index info: SegmentBase@indexRange, SegmentTimeline, SegmentTemplate@duration, SegmentTemplate@index, SegmentList
  • Multi-codec/multi-container manifests (we will negotiate support with the browser and choose the best ones)
  • Encrypted content (including custom ContentProtection schemas, PSSH in the manifest)
  • Key rotation
  • Trick mode tracks

DASH features not supported:

  • Xlink with actuate=onRequest
  • Manifests without any segment info: shaka-project#1088
  • Changing codecs during a presentation (unsupported by MSE)
  • Multiple trick mode tracks for the same resolution at varying framerates or bitrates
  • Timescales so large that timestamps cannot be represented as integers in JavaScript (2^53): shaka-project#1667

HLS features

HLS features supported:

  • VOD, Live, and Event types
  • Encrypted content with Widevine
  • ISO-BMFF / MP4 / CMAF support
  • MPEG-2 TS support (transmuxing provided by mux.js v5.6.3+, must be separately included)
  • WebVTT and TTML
  • CEA-608/708 captions
  • Encrypted content with FairPlay (Safari on macOS and iOS 12+ only)

HLS features not supported:

DRM support matrix

Browser Widevine PlayReady FairPlay ClearKey⁶
Chrome¹ Y - - Y
Firefox² Y - - Y
Edge³ - Y - -
IE 11⁴ - Y - -
Safari - - Y -
Opera untested⁵ - - untested⁵
Chromecast Y Y - untested⁵
Tizen TV Y Y - untested⁵

Other DRM systems should work out of the box if they are interoperable and compliant to the EME spec.

NOTES:

  • ¹: Only official Chrome builds contain the Widevine CDM. Chromium built from source does not support DRM.
  • ²: DRM must be enabled by the user. The first time a Firefox user visits a site with encrypted media, the user will be prompted to enable DRM.
  • ³: PlayReady in Edge does not seem to work on a VM or over Remote Desktop.
  • ⁴: IE 11 offers PlayReady support on Windows 8.1 and Windows 10 only. (IE support will stop in v3.1: shaka-project#2339)
  • ⁵: These are expected to work, but are not actively tested by the Shaka Player team.
  • ⁶: ClearKey is a useful tool for debugging, and does not provide actual content security.

Media container and subtitle support

Shaka Player supports:

  • ISO-BMFF / CMAF / MP4
    • Depends on browser support for the container via MediaSource
    • Can parse "sidx" box for DASH's SegmentBase@indexRange and SegmentTemplate@index
    • Can find and parse "tfdt" box to find segment start time in HLS
  • WebM
    • Depends on browser support for the container via MediaSource
    • Can parse cueing data elements for DASH's SegmentBase@indexRange and SegmentTemplate@index
    • Not supported in HLS
  • MPEG-2 TS
    • With help from mux.js v5.6.3+, can be played on any browser which supports MP4
    • Can find and parse timestamps to find segment start time in HLS
  • WebVTT
    • Supported in both text form and embedded in MP4
  • TTML
    • Supported in both XML form and embedded in MP4

Subtitles are rendered by the browser by default. Applications can create a text display plugin for customer rendering to go beyond browser-supported attributes.

Documentation & Important Links

FAQ

For general help and before filing any bugs, please read the FAQ.

Contributing

If you have improvements or fixes, we would love to have your contributions. Please read CONTRIBUTING.md for more information on the process we would like contributors to follow.

Framework Integrations

The Shaka team doesn't have the bandwidth and experience to provide guidance and support for integrating Shaka Player with specific frameworks, but some of our users have sucessfully done so and created tutorials to help other beginners.

Shaka + ReactJS integrations:

Shaka + Next.js integration:

If you have published Shaka Integration code/tutorials, please feel free to submit PRs to add them to this list, we will gladly approve!

shaka-player's People

Contributors

joeyparrish avatar themodmaker avatar vaage avatar theodab avatar ismena avatar michellezhuogg avatar natalieharris avatar spiralman avatar chrisfillmore avatar hochhaus avatar baconz avatar birme avatar cmgrecu avatar beaufortfrancois avatar leandromoreira avatar muhammadharis avatar jonoward avatar johan avatar niklaskorz avatar objelisks avatar tobbee avatar yohanncon avatar tdrews avatar palmerj3 avatar fadomire avatar bhh1988 avatar valotvince avatar tomasz-oponowicz avatar ross-cz avatar irock avatar

Watchers

James Cloos avatar

shaka-player's Issues

CVE-2015-9251 (Medium) detected in jquery-1.9.1.js

CVE-2015-9251 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.9.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.js

Path to dependency file: shaka-player/node_modules/tinycolor2/index.html

Path to vulnerable library: shaka-player/node_modules/tinycolor2/demo/jquery-1.9.1.js,shaka-player/node_modules/tinycolor2/test/../demo/jquery-1.9.1.js

Dependency Hierarchy:

  • jquery-1.9.1.js (Vulnerable Library)

Found in HEAD commit: 458cc8fc66c54488657924f691b3362abea20ef8

Vulnerability Details

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Publish Date: 2018-01-18

URL: CVE-2015-9251

CVSS 2 Score Details (4.3)

Base Score Metrics not available

Suggested Fix

Type: Change files

Origin: jquery/jquery@f60729f

Release Date: 2015-10-12

Fix Resolution: Replace or update the following files: script.js, ajax.js

CVE-2019-11358 (Medium) detected in jquery-3.2.1.js, jquery-1.9.1.js

CVE-2019-11358 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-3.2.1.js, jquery-1.9.1.js

jquery-3.2.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.js

Path to dependency file: shaka-player/node_modules/fontfaceonload/.grunt/grunt-gh-pages/gh-pages/src/test/test.html

Path to vulnerable library: shaka-player/node_modules/fontfaceonload/.grunt/grunt-gh-pages/gh-pages/src/test/../bower_components/jquery/dist/jquery.js

Dependency Hierarchy:

  • jquery-3.2.1.js (Vulnerable Library)
jquery-1.9.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.js

Path to dependency file: shaka-player/node_modules/tinycolor2/index.html

Path to vulnerable library: shaka-player/node_modules/tinycolor2/demo/jquery-1.9.1.js,shaka-player/node_modules/tinycolor2/test/../demo/jquery-1.9.1.js

Dependency Hierarchy:

  • jquery-1.9.1.js (Vulnerable Library)

Found in HEAD commit: 458cc8fc66c54488657924f691b3362abea20ef8

Vulnerability Details

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

Publish Date: 2019-04-20

URL: CVE-2019-11358

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358

Release Date: 2019-04-20

Fix Resolution: 3.4.0

CVE-2020-8175 (Medium) detected in jpeg-js-0.3.7.tgz

CVE-2020-8175 - Medium Severity Vulnerability

Vulnerable Library - jpeg-js-0.3.7.tgz

A pure javascript JPEG encoder and decoder

Library home page: https://registry.npmjs.org/jpeg-js/-/jpeg-js-0.3.7.tgz

Path to dependency file: shaka-player/package.json

Path to vulnerable library: shaka-player/node_modules/jpeg-js/package.json

Dependency Hierarchy:

  • jimp-0.11.0.tgz (Root Library)
    • types-0.11.0.tgz
      • jpeg-0.11.0.tgz
        • jpeg-js-0.3.7.tgz (Vulnerable Library)

Vulnerability Details

Uncontrolled resource consumption in jpeg-js before 0.4.0 may allow attacker to launch denial of service attacks using specially a crafted JPEG image.

Publish Date: 2020-07-24

URL: CVE-2020-8175

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8175

Release Date: 2020-07-21

Fix Resolution: 0.4.0

WS-2019-0209 (Medium) detected in marked-0.6.3.tgz

WS-2019-0209 - Medium Severity Vulnerability

Vulnerable Library - marked-0.6.3.tgz

A markdown parser built for speed

Library home page: https://registry.npmjs.org/marked/-/marked-0.6.3.tgz

Path to dependency file: shaka-player/package.json

Path to vulnerable library: shaka-player/node_modules/marked/package.json

Dependency Hierarchy:

  • jsdoc-4.0.0-dev.tgz (Root Library)
    • marked-0.6.3.tgz (Vulnerable Library)

Found in HEAD commit: 458cc8fc66c54488657924f691b3362abea20ef8

Vulnerability Details

marked before 0.7.0 vulnerable to Redos attack by he _label subrule that may significantly degrade parsing performance of malformed input.

Publish Date: 2019-07-04

URL: WS-2019-0209

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1076

Release Date: 2019-09-05

Fix Resolution: 0.7.0

CVE-2020-11022 (Medium) detected in jquery-3.2.1.js, jquery-1.9.1.js

CVE-2020-11022 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-3.2.1.js, jquery-1.9.1.js

jquery-3.2.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.js

Path to dependency file: shaka-player/node_modules/fontfaceonload/.grunt/grunt-gh-pages/gh-pages/src/test/test.html

Path to vulnerable library: shaka-player/node_modules/fontfaceonload/.grunt/grunt-gh-pages/gh-pages/src/test/../bower_components/jquery/dist/jquery.js

Dependency Hierarchy:

  • jquery-3.2.1.js (Vulnerable Library)
jquery-1.9.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.js

Path to dependency file: shaka-player/node_modules/tinycolor2/index.html

Path to vulnerable library: shaka-player/node_modules/tinycolor2/demo/jquery-1.9.1.js,shaka-player/node_modules/tinycolor2/test/../demo/jquery-1.9.1.js

Dependency Hierarchy:

  • jquery-1.9.1.js (Vulnerable Library)

Found in HEAD commit: 458cc8fc66c54488657924f691b3362abea20ef8

Vulnerability Details

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11022

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

Release Date: 2020-04-29

Fix Resolution: jQuery - 3.5.0

WS-2019-0017 (Medium) detected in clean-css-3.4.28.tgz

WS-2019-0017 - Medium Severity Vulnerability

Vulnerable Library - clean-css-3.4.28.tgz

A well-tested CSS minifier

Library home page: https://registry.npmjs.org/clean-css/-/clean-css-3.4.28.tgz

Path to dependency file: shaka-player/package.json

Path to vulnerable library: shaka-player/node_modules/clean-css/package.json

Dependency Hierarchy:

  • less-plugin-clean-css-1.5.1.tgz (Root Library)
    • clean-css-3.4.28.tgz (Vulnerable Library)

Found in HEAD commit: 458cc8fc66c54488657924f691b3362abea20ef8

Vulnerability Details

Version of clean-css prior to 4.1.11 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.

Publish Date: 2018-03-06

URL: WS-2019-0017

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/785

Release Date: 2019-02-21

Fix Resolution: v4.1.11

CVE-2020-8244 (Medium) detected in bl-4.0.2.tgz

CVE-2020-8244 - Medium Severity Vulnerability

Vulnerable Library - bl-4.0.2.tgz

Buffer List: collect buffers and access with a standard readable Buffer interface, streamable too!

Library home page: https://registry.npmjs.org/bl/-/bl-4.0.2.tgz

Path to dependency file: shaka-player/package.json

Path to vulnerable library: shaka-player/node_modules/bl/package.json

Dependency Hierarchy:

  • karma-webdriver-launcher-1.0.8.tgz (Root Library)
    • wd-1.12.1.tgz
      • archiver-3.1.1.tgz
        • tar-stream-2.1.3.tgz
          • bl-4.0.2.tgz (Vulnerable Library)

Vulnerability Details

A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.

Publish Date: 2020-08-30

URL: CVE-2020-8244

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8244

Release Date: 2020-07-21

Fix Resolution: 2.2.1,3.0.1,4.0.3

WS-2019-0019 (Medium) detected in braces-1.8.5.tgz - autoclosed

WS-2019-0019 - Medium Severity Vulnerability

Vulnerable Library - braces-1.8.5.tgz

Fastest brace expansion for node.js, with the most complete support for the Bash 4.3 braces specification.

Library home page: https://registry.npmjs.org/braces/-/braces-1.8.5.tgz

Path to dependency file: /tmp/ws-scm/shaka-player/package.json

Path to vulnerable library: /tmp/ws-scm/shaka-player/node_modules/braces/package.json

Dependency Hierarchy:

  • babel-plugin-istanbul-4.1.6.tgz (Root Library)
    • test-exclude-4.2.3.tgz
      • micromatch-2.3.11.tgz
        • braces-1.8.5.tgz (Vulnerable Library)

Found in HEAD commit: 458cc8fc66c54488657924f691b3362abea20ef8

Vulnerability Details

Version of braces prior to 2.3.1 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.

Publish Date: 2018-02-16

URL: WS-2019-0019

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/786

Release Date: 2019-02-21

Fix Resolution: 2.3.1

CVE-2020-11023 (Medium) detected in jquery-3.2.1.js, jquery-1.9.1.js

CVE-2020-11023 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-3.2.1.js, jquery-1.9.1.js

jquery-3.2.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.js

Path to dependency file: shaka-player/node_modules/fontfaceonload/.grunt/grunt-gh-pages/gh-pages/src/test/test.html

Path to vulnerable library: shaka-player/node_modules/fontfaceonload/.grunt/grunt-gh-pages/gh-pages/src/test/../bower_components/jquery/dist/jquery.js

Dependency Hierarchy:

  • jquery-3.2.1.js (Vulnerable Library)
jquery-1.9.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.js

Path to dependency file: shaka-player/node_modules/tinycolor2/index.html

Path to vulnerable library: shaka-player/node_modules/tinycolor2/demo/jquery-1.9.1.js,shaka-player/node_modules/tinycolor2/test/../demo/jquery-1.9.1.js

Dependency Hierarchy:

  • jquery-1.9.1.js (Vulnerable Library)

Vulnerability Details

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11023

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11023

Release Date: 2020-04-29

Fix Resolution: jquery - 3.5.0

CVE-2020-7598 (Medium) detected in minimist-0.0.10.tgz

CVE-2020-7598 - Medium Severity Vulnerability

Vulnerable Library - minimist-0.0.10.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.10.tgz

Path to dependency file: shaka-player/package.json

Path to vulnerable library: shaka-player/node_modules/optimist/node_modules/minimist/package.json

Dependency Hierarchy:

  • karma-4.4.1.tgz (Root Library)
    • optimist-0.6.1.tgz
      • minimist-0.0.10.tgz (Vulnerable Library)

Found in HEAD commit: 458cc8fc66c54488657924f691b3362abea20ef8

Vulnerability Details

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload.

Publish Date: 2020-03-11

URL: CVE-2020-7598

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/substack/minimist/commit/63e7ed05aa4b1889ec2f3b196426db4500cbda94

Release Date: 2020-03-11

Fix Resolution: minimist - 0.2.1,1.2.3

WS-2020-0163 (Medium) detected in marked-0.6.3.tgz

WS-2020-0163 - Medium Severity Vulnerability

Vulnerable Library - marked-0.6.3.tgz

A markdown parser built for speed

Library home page: https://registry.npmjs.org/marked/-/marked-0.6.3.tgz

Path to dependency file: shaka-player/package.json

Path to vulnerable library: shaka-player/node_modules/marked/package.json

Dependency Hierarchy:

  • jsdoc-4.0.0-dev.tgz (Root Library)
    • marked-0.6.3.tgz (Vulnerable Library)

Vulnerability Details

marked before 1.1.1 is vulnerable to Regular Expression Denial of Service (REDoS). rules.js have multiple unused capture groups which can lead to a Denial of Service.

Publish Date: 2020-07-02

URL: WS-2020-0163

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/markedjs/marked/releases/tag/v1.1.1

Release Date: 2020-07-02

Fix Resolution: marked - 1.1.1

CVE-2020-7608 (Medium) detected in yargs-parser-10.1.0.tgz

CVE-2020-7608 - Medium Severity Vulnerability

Vulnerable Library - yargs-parser-10.1.0.tgz

the mighty option parser used by yargs

Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-10.1.0.tgz

Path to dependency file: shaka-player/package.json

Path to vulnerable library: shaka-player/node_modules/yargs-parser/package.json

Dependency Hierarchy:

  • stylelint-10.1.0.tgz (Root Library)
    • meow-5.0.0.tgz
      • yargs-parser-10.1.0.tgz (Vulnerable Library)

Found in HEAD commit: 458cc8fc66c54488657924f691b3362abea20ef8

Vulnerability Details

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload.

Publish Date: 2020-03-16

URL: CVE-2020-7608

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7608

Release Date: 2020-03-16

Fix Resolution: v18.1.1;13.1.2;15.0.1

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.