Detections
Analytics

SCA: security update for azle (GHSA-xc76-5pf9-mx8m)

high Tenable Cloud Security Plugin ID 421130

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Azle is a WebAssembly runtime for TypeScript and JavaScript on ICP. Calling `setTimer` in Azle versions
 `0.27.0`, `0.28.0`, and `0.29.0` causes an immediate infinite loop of timers to be executed on the
 canister, each timer attempting to clean up the global state of the previous timer. The infinite loop will
 occur with any valid invocation of `setTimer`. The problem has been fixed as of Azle version `0.30.0`. As
 a workaround, if a canister is caught in this infinite loop after calling `setTimer`, the canister can be
 upgraded and the timers will all be cleared, thus ending the loop. (CVE-2025-29776)

See Also

https://github.com/advisories/GHSA-xc76-5pf9-mx8m

Plugin Details

Severity: High

ID: 421130

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 3/14/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.92

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2025-29776

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 6.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/14/2025

Vulnerability Publication Date: 3/14/2025

Reference Information

CVE: CVE-2025-29776

cwe: CWE-835