AIKIDO-2026-10529
shaka-player is vulnerable to Denial of Service
42
Medium Risk
This Affects:
shaka-playerTL;DR
Affected versions of this package are vulnerable to a denial of service in shaka.util.TXml.parse, where parsing a deeply nested XML manifest can trigger unbounded recursion between parseNode and parseChildren, exhausting the JavaScript call stack and causing a RangeError that may crash the browser tab. An attacker could exploit this by supplying a malicious XML document with extreme nesting depth, causing the parser to fail during processing and disrupting application availability.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
shaka-player is vulnerable to Denial of Service in versions 4.0.0 - 4.15.38, 4.16.0 - 4.16.26 and 5.0.0 - 5.0.10.
How to fix this
Upgrade the shaka-player library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.