If I get another AI slop CVE from Wayde Shi I am going to loose it.
Theres constantly a new "exploit" reported by someone named "Wayde Shi" who claims to work at PayPal (i really hope thats not true)
And every single time I stumble upon
npm audit noise with no fix available its from this dude.
Last time it took a good month to get his bullshit CVE taken down https://github.com/github/advisory-database/pull/10132
Does anyone even know who this is? Searching the web just turns up a bunch of CVEs that are questionable at best and get high CVSS scores on VulnCheck (the CNA publishing his slop) while other severly downgrade the scores.GitHub[GHSA-vfj7-8cjw-p6xm] braces vulnerable to stack-exhaustion denial of service through deeply nested patterns by ericcornelissen · Pull Request #10132 · github/advisory-databaseUpdates Affected products CVSS v3 Comments No version of braces is affected by this. Observe the following two facts: 1) A RangeError in Node.js1 is catchable. 2) The braces API may already throw...
commit aecd25a