CVE-2021-3804: Inefficient Regular Expression Complexity in @tarojs/helper
Summary
CVE-2021-3804: Inefficient Regular Expression Complexity in taro. Affects @tarojs/helper versions < 3.3.9. Fixed in 3.3.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @tarojs/helper package is a part of the Taro framework, which is a popular open-source framework for developing cross-platform applications. It provides various utility functions and tools to enhance the development experience. However, the package is vulnerable to an inefficient regular expression complexity issue.
Vulnerability Detail
The vulnerability in @tarojs/helper arises from inefficient regular expressions, which can lead to excessive backtracking and result in denial-of-service attacks. An attacker can craft a specially crafted input that triggers this vulnerability, causing the application to consume excessive CPU resources and potentially become unresponsive. This vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
3.3.9
This is the first release that contains the fix.
npm install @tarojs/helper@3.3.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The @tarojs/helper package is vulnerable to an inefficient regular expression complexity issue. To mitigate this vulnerability, it is recommended to update the package to version 3.3.9 or later. This update includes a fix for the issue. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @tarojs/helper →
FAQ
This vulnerability can be exploited by an attacker to launch denial-of-service attacks, potentially rendering the affected application unresponsive.
At the moment, there is no known workaround for this vulnerability. It is recommended to update the @tarojs/helper package to the latest version.
No, versions prior to 3.3.9 are affected by this vulnerability. Updating to version 3.3.9 or later will address the issue.
Yes, this vulnerability can be exploited remotely by sending specially crafted inputs to the affected application.
There is no known instance of this vulnerability being exploited in the wild at the moment. However, it is crucial to update the package to mitigate the risk.
