Gosub Engine
Monthly
Stack exhaustion in the Gosub browser engine (gosub-engine through 0.1.0 and main before commit 46868b3) lets a remote, unauthenticated attacker crash any application built on the engine by getting it to render an SVG document containing an excessive number of deeply nested elements. The malicious SVG can be embedded via the SRC attribute of an IMG element on an attacker-controlled page, so exploitation requires only that a victim visit that page (UI:P) - no credentials are needed (PR:N) and the attack is network-reachable (AV:N). Impact is availability-only (a hard crash of the host application; no data exposure or code execution), no public exploit code has been identified at time of analysis, and the practical exposure is limited to the narrow set of deployments embedding the engine at those revisions, making this a genuine but low-priority issue.
Stack exhaustion in the Gosub browser engine (gosub-engine through 0.1.0 and main before commit 46868b3) lets a remote, unauthenticated attacker crash any application built on the engine by getting it to render an SVG document containing an excessive number of deeply nested elements. The malicious SVG can be embedded via the SRC attribute of an IMG element on an attacker-controlled page, so exploitation requires only that a victim visit that page (UI:P) - no credentials are needed (PR:N) and the attack is network-reachable (AV:N). Impact is availability-only (a hard crash of the host application; no data exposure or code execution), no public exploit code has been identified at time of analysis, and the practical exposure is limited to the narrow set of deployments embedding the engine at those revisions, making this a genuine but low-priority issue.