high7.5
CVE-2020-36649
Regular Expression Denial of Service in papaparse
Impact
Versions of `papaparse` prior to 5.2.0 are vulnerable to Regular Expression Denial of Service (ReDos). The `parse` function contains a malformed regular expression that takes exponentially longer to process non-numerical inputs. This allows attackers to stall systems and lead to Denial of Service. ## Recommendation Upgrade to version 5.2.0 or later.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | papaparse | < 5.2.0 | 5.2.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Papaparse | Papaparse | from 5.1.0 before 5.2.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/mholt/PapaParse/commit/235a12758cd77266d2e98fd715f53536b34ad621
- https://github.com/mholt/PapaParse/issues/777
- https://github.com/mholt/PapaParse/pull/779
- https://github.com/mholt/PapaParse/releases/tag/5.2.0
- https://vuldb.com/?ctiid.218004
- https://vuldb.com/?id.218004
- https://github.com/advisories/GHSA-qvjc-g5vr-mfgr
- https://snyk.io/vuln/SNYK-JS-PAPAPARSE-564258
- https://nvd.nist.gov/vuln/detail/CVE-2020-36649