GitHub Advisoryadvisory · npm

GHSA-hhfg-6hfc-rvxm Regular Expression Denial of Service in jsoneditor

MEDIUM Published 2021-09-29 Modified 2022-05-04 Official page ↗
Aliases
CVE-2021-3822
Ecosystem
npm
Packages
jsoneditor
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-1333, CWE-400, CWE-697
Reviewed
2021-09-28

Affected packages

• npm jsoneditor: < 9.5.6 → fixed in 9.5.6

Description

JSON Editor is a web-based tool to view, edit, format, and validate JSON. It has various modes such as a tree editor, a code editor, and a plain text editor. The jsoneditor package is vulnerable to ReDoS (regular expression denial of service). An attacker that is able to provide a crafted element as input to the getInnerText function may cause an application to consume an excessive amount of CPU. Below pinned line using vulnerable regex.

Related

Alias · CVE (1)

  • CVE-2021-3822 jsoneditor is vulnerable to Inefficient Regular Expression Complexity vulnerability

Weakness · CWE (3)

  • CWE-1333 Inefficient Regular Expression Complexity weakness
  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-697 Incorrect Comparison weakness

References