The dssrf-js package is affected by a high-severity vulnerability that permits unauthorized manipulation of special elements, posing a risk of system integrity compromise.

The software suffers from an improper neutralization of special elements (CWE-76), which can be exploited by an unauthenticated attacker via the network to achieve impact on system integrity.

The vulnerability carries a CVSS score of 8.7, reflecting a high-severity risk to business operations. Successful exploitation could allow attackers to bypass security controls, potentially leading to unauthorized data modification or the execution of unintended actions within the application environment, resulting in significant reputational or operational damage.

Immediate Action: Update the dssrf-js package to version 1.0.4 or later immediately.

Proactive Monitoring: Review application logs for unusual request patterns or unexpected input strings that may indicate attempts to leverage special character sequences for exploitation.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to sanitize input and detect common injection attempts targeting special elements.

Public Exploit Available: Unknown

Given the high CVSS score and the existence of a proof-of-concept, organizations using dssrf-js should prioritize updating to version 1.0.4 immediately. Failure to remediate this flaw exposes the application to potential integrity-based attacks that can be automated by remote, unauthenticated actors.