GitHub Advisoryadvisory · npm

GHSA-v63q-hgqc-qvpg MooTools Regular Expression Denial of Service

HIGH Published 2023-01-03 Modified 2024-04-02 Official page ↗
Aliases
CVE-2021-32821
Ecosystem
npm
Packages
mootools
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1333, CWE-400
Reviewed
2024-04-02

Affected packages

• npm mootools: <= 1.5.2 (no fix yet)

Description

MooTools is a collection of JavaScript utilities for JavaScript developers. All known versions include a CSS selector parser that is vulnerable to Regular Expression Denial of Service (ReDoS). An attack requires that an attacker can inject a string into a CSS selector at runtime, which is quite common with e.g. jQuery CSS selectors. No patches are available for this issue.

Related

Alias · CVE (1)

  • CVE-2021-32821 MooTools is a collection of JavaScript utilities for JavaScript developers. vulnerability

Weakness · CWE (2)

  • CWE-1333 Inefficient Regular Expression Complexity weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References