AI Security agent warning when installing Modernizr 3.13.1

CWE: CWE-400 OWASP: A06:2021 – Vulnerable and Outdated Components Confidence: HIGH

Description: The linkify-it dependency (used by markdown-it via modernizr) contains quadratic algorithmic complexity vulnerabilities in the match scan loop and mailto: validator. Processing large amounts of attacker-controlled text can cause significant CPU consumption.

Vulnerable Code:

"modernizr": "3.13.1"

Attack Vector: Attacker provides a large input containing specially crafted URLs or mailto: links that trigger the quadratic complexity path, causing excessive CPU usage.

Impact: Application becomes unresponsive, high CPU consumption, denial of service affecting availability.

Remediation: Update linkify-it to version 5.0.2 or later, and markdown-it to version 14.1.2 or later, which contain fixes for these vulnerabilities.

References:

• https://github.com/advisories/GHSA-22p9-wv53-3rq4
• https://github.com/advisories/GHSA-v245-v573-v5vm