corporate

news/blog

English

XSRF-TOKEN

landing_page

secureSp_session

_clck

cookieyes-consent

_uetsid

_gcl_au

_ga_0N1GKGY9KZ

gdpr_consent

wpdiscuz_nonce_538b793ed1cd3bd4487e766ba433cbe8

_clsk

_uetvid

cookieconsent_status

consent

euconsent

The domain name 'www.scalablepath.com' uses the commercial generic top-level domain (.com), featuring subdomain 'www'. Its registrable label 'scalablepath' stretches across 12 characters with four vowels and 8 consonants. Splitting it apart reveals 2 words: scalable, path. Median word length comes out to six characters. No strong language cues emerged from the frequency lists.

html/8a/1d/8a1df65a-a43f-4e03-93ac-cd4a8ff957a1.html.gz

script-src 'none'; frame-src 'none'; sandbox;

img-src 'self' *.scalablepath.com googleads.g.doubleclick.net *.s3.us-west-1.amazonaws.com *.cloudinary.com *.bugsnag.com *.mapbox.com *.linkedin.com *.ads.linkedin.com *.adsymptotic.com snap.licdn.com www.googletagmanager.com *.googleusercontent.com *.google-analytics.com *.google.com *.google.ad *.google.ae *.google.com.af *.google.com.ag *.google.com.ai *.google.al *.google.am *.google.co.ao *.google.com.ar *.google.as *.google.at *.google.com.au *.google.az *.google.ba *.google.com.bd *.google.be *.google.bf *.google.bg *.google.com.bh *.google.bi *.google.bj *.google.com.bn *.google.com.bo *.google.com.br *.google.bs *.google.bt *.google.co.bw *.google.by *.google.com.bz *.google.ca *.google.cd *.google.cf *.google.cg *.google.ch *.google.ci *.google.co.ck *.google.cl *.google.cm *.google.cn *.google.com.co *.google.co.cr *.google.com.cu *.google.cv *.google.com.cy *.google.cz *.google.de *.google.dj *.google.dk *.google.dm *.google.com.do *.google.dz *.google.com.ec *.google.ee *.google.com.eg *.google.es *.google.com.et *.google.fi *.google.com.fj *.google.fm *.google.fr *.google.ga *.google.ge *.google.gg *.google.com.gh *.google.com.gi *.google.gl *.google.gm *.google.gr *.google.com.gt *.google.gy *.google.com.hk *.google.hn *.google.hr *.google.ht *.google.hu *.google.co.id *.google.ie *.google.co.il *.google.im *.google.co.in *.google.iq *.google.is *.google.it *.google.je *.google.com.jm *.google.jo *.google.co.jp *.google.co.ke *.google.com.kh *.google.ki *.google.kg *.google.co.kr *.google.com.kw *.google.kz *.google.la *.google.com.lb *.google.li *.google.lk *.google.co.ls *.google.lt *.google.lu *.google.lv *.google.com.ly *.google.co.ma *.google.md *.google.me *.google.mg *.google.mk *.google.ml *.google.com.mm *.google.mn *.google.ms *.google.com.mt *.google.mu *.google.mv *.google.mw *.google.com.mx *.google.com.my *.google.co.mz *.google.com.na *.google.com.ng *.google.com.ni *.google.ne *.google.nl *.google.no *.google.com.np *.google.nr *.google.nu *.google.co.nz *.google.com.om *.google.com.pa *.google.com.pe *.google.com.pg *.google.com.ph *.google.com.pk *.google.pl *.google.pn *.google.com.pr *.google.ps *.google.pt *.google.com.py *.google.com.qa *.google.ro *.google.ru *.google.rw *.google.com.sa *.google.com.sb *.google.sc *.google.se *.google.com.sg *.google.sh *.google.si *.google.sk *.google.com.sl *.google.sn *.google.so *.google.sm *.google.sr *.google.st *.google.com.sv *.google.td *.google.tg *.google.co.th *.google.com.tj *.google.tl *.google.tm *.google.tn *.google.to *.google.com.tr *.google.tt *.google.com.tw *.google.co.tz *.google.com.ua *.google.co.ug *.google.co.uk *.google.com.uy *.google.co.uz *.google.com.vc *.google.co.ve *.google.vg *.google.co.vi *.google.com.vn *.google.vu *.google.ws *.google.rs *.google.co.za *.google.co.zm *.google.co.zw *.google.cat q.quora.com www.facebook.com *.bing.com www.clarity.ms www.hotjar.com www.youtube.com ytimg.com c.clarity.ms formfacade.com cdn-cookieyes.com blob: data:; default-src https: 'unsafe-inline' data: 'unsafe-eval' wss: blob:

appId=cid-v1:a894a21c-0197-44e5-b203-3cbc01252c82

multipart/form-data; boundary=----WebKitFormBoundaryPIi7y0Pf1QfMkOuo

frame-ancestors 'self' chrome-extension://alhgpfoeiimagjlnfekdhkjlkiomcapa chrome-extension://ececkagaccnfmkopaiemklekhoimmgpn *.salesforce.com *.lightning.force.com; report-uri https://o101058.ingest.us.sentry.io/api/222018/security/?sentry_key=86bb17dd8c2449719dd6b498f3431191&sentry_environment=production&sentry_release=74bbfa5297934038de3f3220735427c7cfc8d36a

appId=cid-v1:a449a586-8786-487f-a449-dc1b282a2628

script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:139:0

Article comments

6c5817d6aacbe7ffda48e245bc7b4ad0bd7adf8304b8ff582575f0a8d6935641

d08f53edffd1a2c1827317f47af47b50ded2c093748ab65d91b7a07cda542406

0aee7e10d465c71a0e4b922f0fb5fc66158a4cfea098340b2e6efdccedfa9344

01db29325771abec2c0d9e6b8913dc5b82845902fc6b83eebcb3f178521f66b4

3514fcdd413bec1074d042959f0e1c43cfb8031cc951e9a899e218b24437e3bd

b949547b2d8f087fd3fb2e0e17251744fc923cabefe525c44b3eb5ee1d9fd29e

201554c91f6d69aced4e646eb15677e385944c91741a8cadb62ab807f645a98a

f85947120e27e10e1c1a9d0529aa27dfcda3bf637b773a6ebd89fcf58f662541

7cc22424f5ab619871f9736bc84d4765839042a9a4faae13d69932f83b0e463d

0331f3874356ed64b61c774c4959b1313b39d84bac2a0e8868ec3a8fa1ea0feb

2b7a2d57739f073fc9c01475f758792fa6b19c81101b2e42e4234ae63f7d850d

59b367310d62b21bd0dc6983e96f9ae34f8bf0e0056ed5634113791ca090fe2d

6e6d015ce230abd8bdf7584c62ef4a7225313b9e04d6c8caa18d12691a4f1151

84cd097bc4e336969533c007fe4a0cd55ce99812eb51640354fce81b3bd8358c

f7ba074f0b6d4c724400aa20614526c6d7df008864664dcc1d3d43024ab6aedd

6e187798f38903d98819498dfa7d58da47db4e8fcfd5f76bb27e6abe90bda262

953f30cf4470245803633c2eea03b4575ffca0727529c95e07908a609e603341

a236defd861c4d5c3daff5f76f774fa8207980aa8df746aefa493ada81fbefef

49f64a87ea0f27424b245dce45ca241085b267d53e3d459e8389d3a8007a5d86

fc1fb9ba18ecc89d8909d49f43242232eb2fbd6758606fed287d170261938e61

dac35f2186d122c38346aa16acfd5a85a84d593357e15a569ded79cfa11769f3

83e71916a6060cfbfd41d1825255950dfd4b82e8241aa428f6276344cefb9819

855230e1321917153b6859521e1ccfab0dce7497f88645e73d7e6db9c4bbe3b1

a52839ee4a1aba7f71ee4ff71eae4794914583b962636bda7d2ee3bb303788ac

e39c1e1a3d9176830821ef63856b3150d4b8ced964fb3b2098c602c097d65b99

23afe9bbf503cfbe9bd3d45d1932680fb0c1a7bf2823a75168e54e482c4e93a5

df96bf0b6ed73f13ebe865501ab1863d77064097275fe8137447a54c58134888

9b220bbcbfaa8c2a0be59188fd09628837e42e8ac3edfec71efee612edab3e7d

556c5283eb553603032cad1b799cc4461e6d9dc993b78e52e19c2751049b19ab

c8550f9644492f2d1278467b301c615c768a0d61d5c22d5bcd107ec7c9cbd329

e1aa8b35ea48b1a7b33a35e0219354e4c333ed4e17dee11200078af3b5a401b4

43d01b811284e48be9b9dea4724488fd68a648a25bcd7e7023105b8c8764e0eb

d2c89b3bf8984c588c71dea658b30c00411cc966f42777b66280003c8ab6d386

3a04664de5213cdc172b43656d29dcd2414d33183a10b537ea98c6e1e24c9c45

03ed24ff9d7641f31cdc7e3f601b3ed032add2e29db53d615eb004d5823e541a

75c18c8aefd81dd9d2b00d1501b735c0a7c83fe37c62ec5b4152a65fc38d8937

75f96e3952806eab40e365a30d136b4dc2f28a26f34080711449f3e007f8d9fc

5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89

8ee0654259fda0bbfeab4305b895e740659613080d90352bd36c1452fd426ef6

446232761806825306408235afe9dfed80f95ce3c8e3e894155661e6f1e9c381

700c8bd73d93522ca53cdc35e2a71e96caf7c344bc7a8391f3af90c10b917033

b5146785fa8805a2c78e7919bbcfa0ce1019d678a0a015ad403501df4fa19ef4

cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf

f95c738a8709cbf110149dcae10e3729be6bef3843b87412e38653ff24ec4211

9d4687a19cab8f7442a3bda40c45be4d10e42488e091ddd706c3caed83c3ee1f

### Impact

Affected versions of this package are vulnerable to Prototype Pollution.  A malicious HTML code block can be crafted that will result in prototype pollution of the base object's prototype during highlighting.  If you allow users to insert custom HTML code blocks into your page/app via parsing Markdown code blocks (or similar) and do not filter the language names the user can provide you may be vulnerable. 

The pollution should just be harmless data but this can cause problems for applications not expecting these properties to exist and can result in strange behavior or application crashes, i.e. a potential DOS vector. 

_If your website or application does not render user provided data it should be unaffected._

### Patches

Versions 9.18.2 and 10.1.2 and newer include fixes for this vulnerability.  If you are using version 7 or 8 you are encouraged to upgrade to a newer release.

### Workarounds

#### Patch your library

Manually patch your library to create null objects for both `languages` and `aliases`:

```js
const HLJS = function(hljs) {
  // ...
  var languages = Object.create(null);
  var aliases = Object.create(null);
```

#### Filter out bad data from end users:

Filter the language names that users are allowed to inject into your HTML to guarantee they are valid.

### References

* [What is Prototype Pollution?](https://codeburst.io/what-is-prototype-pollution-49482fc4b638)
* https://github.com/highlightjs/highlight.js/pull/2636

### For more information

If you have any questions or comments about this advisory:

* Please file an issue against [highlight.js](https://github.com/highlightjs/highlight.js/issues/)

5ec13a11b206a234547355f17a67d2d3ae9476522cd3bbb7bfbd56c2b7f12dd0

0973c1d64c88adc8e3c950410cb58b288f72118d5965b78049438deb8f2f9683

8f477a44430d44d8da80f76d7e0e11eb3ff1ae95c2ab4fdd19063cfc821bc9f2

8fb3e06a95f6b072a26f7cbeb3301d7fdd21a91bedf8e8bbb2e3e1774ba8d2da

c4d87df3d3a8ef88cbb66a9e6617cc74dc8552ccd4fa50436091f4f478d74f7e

e3b9b15f1facdb73ae1a65c22bf5dd46ae71335841cf949a03afeb18fd790b6b

9720755c4acacb0a458e155655a97585cfdafdf6b7bdbd1ee3ee2a2d8271b0c5

27490d97d2471485afb935ecfb203f1bc6204c98c6f78c1d53a52582e6a67424

9e9149d67c9538695aa6455e10a8c6c20696651c003187887763bc6c354d2b72

4edcc6d1d87f9b35e724b9ec376e4554b2ef2f59f07384d468e7b8ad7c0ed814

e3757902630d359b4e4c48d9d384842e8f4f55850cd383e09cbea546a5be681f

Apply as a Freelancer
Apply as a Freelancer

width=device-width, initial-scale=1, shrink-to-fit=no, user-scalable=0

viewport

Hugging Face is a transformative tool for natural language processing. Learn about machine learning models, datasets, and spaces.

description

https://www.scalablepath.com/ai/hugging-face

What is Hugging Face? The ML Platform For Building AI-Powered Apps | Scalable Path

https://cdn-blog.scalablepath.com/uploads/2024/06/huggingface.png

twitter:card

twitter:site

twitter:title

mobile-web-app-capable

apple-mobile-web-app-capable

apple-mobile-web-app-status-bar-style

msvalidate.01

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

GoDaddy.com, LLC

SCALABLEPATH.COM

Amazon EC2 Abuse

IP Management

Amazon AWS Network Operations

Amazon.com, Inc.

AWS RPKI Management POC

IP Routing

Amazon EC2 Network Operations

AMAZON-CF

What is Hugging Face? The ML Platform For Building AI-Powered Apps


                    (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
                    new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
                    j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
                    'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
                    })(window,document,'script','dataLayer','GTM-KDSD2Q3');
                  


          _linkedin_partner_id = "3599140";
          window._linkedin_data_partner_ids = window._linkedin_data_partner_ids || [];
          window._linkedin_data_partner_ids.push(_linkedin_partner_id);
        


          (
            function(l) {
              if (!l){
                window.lintrk = function(a,b){window.lintrk.q.push([a,b])};
                window.lintrk.q=[]
              }
              var s = document.getElementsByTagName('script')[0];
              var b = document.createElement("script");
              b.type = "text/javascript";
              b.async = true;
              b.src = "https://snap.licdn.com/li.lms-analytics/insight.min.js";
              s.parentNode.insertBefore(b, s);}
            )(window.lintrk);
          

(function(a,e,b,f,g,c,d){a[b]=a[b]||function(){(a[b].q=a[b].q||[]).push(arguments)};c=e.createElement(f);c.async=1;c.src="https://www.clarity.ms/tag/"+g;d=e.getElementsByTagName(f)[0];d.parentNode.insertBefore(c,d)})(window,document,"clarity","script","ir3c1q5wdg");

Damien Filiatrault

Scalable Path

Requests	IP Address	Location	AS Autonomous System
35	3.160.150.85Cloudfront · CDN	United States	AS16509Amazon.com, Inc.
34	108.138.7.86Cloudfront · CDN	United States	AS16509Amazon.com, Inc.
34	5.78.154.243	Hillsboro, Oregon, United States	AS212317Hetzner Online GmbH
103	3	-	-

Security Scan Report: www.scalablepath.com

Summary

AI Security Verdict

Safe Website

Safety Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies6

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History