GHSA-vpgc-7h78-gx8f: 
JavaScript vulnerability analysis and mitigation

A low severity security vulnerability was discovered in personnummer/js library affecting versions prior to 3.1.0. The vulnerability was reported to the personnummer team in June 2020, with a delayed response due to locked ownership of some affected packages. The issue impacts the validation of Swedish personal identity numbers (personnummer) (GitHub Advisory).

The vulnerability stems from an improper input validation where the regular expression allows the first three digits in the last four digits of the personnummer to be '000', which is invalid according to Swedish personal number format rules (GitHub Advisory).

This vulnerability affects users who rely on the validation of the last four digits of personnummer to be a real personnummer. The impact is considered low severity according to the assessment (GitHub Advisory).

No specific exploit details have been publicly disclosed. The vulnerability has been assigned the identifier GHSA-vpgc-7h78-gx8f, though no CVE ID has been associated with this issue (GitHub Advisory).

The issue has been patched in version 3.1.0 of the JavaScript implementation. For users unable to upgrade immediately, a workaround is available by implementing an additional check on the last four digits to ensure they're not in the format '000x'. The fix has been implemented across multiple language implementations including C# (3.0.2), Java (3.3.0), PHP (3.0.2), Python (3.0.2), and others (GitHub Advisory).