GitHub Advisoryadvisory · npm

GHSA-mmh6-m7v9-5956 Regular expression denial of service in markdown-link-extractor

LOW Published 2022-06-03 Modified 2022-06-03 Official page ↗
Aliases
CVE-2021-43308
Ecosystem
npm
Packages
markdown-link-extractor
Severity
Low
Weaknesses
CWE-1333
Reviewed
2022-06-03

Affected packages

• npm markdown-link-extractor: < 3.0.2 → fixed in 3.0.2 • npm markdown-link-extractor: >= 4.0.0, < 4.0.1 → fixed in 4.0.1

Description

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbitrary input to the module's exported function

Related

Alias · CVE (1)

  • CVE-2021-43308 An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the markdown-link-extractor npm package, when an attacker… vulnerability

Weakness · CWE (1)

  • CWE-1333 Inefficient Regular Expression Complexity weakness

References