ReDoS Vulnerability in CodeMirror Package: CVE-2020-7760
Summary
CVE-2020-7760: This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. Affects codemirror-js across 3 version ranges.
< 5.58.2+~cs0.23.101-1
< 55d0333907117c9231ffdf555ae8824705993bbb
< 264022ee4af4abca1c158944dc299a8faf8696d6
Fixed in 5.58.2+~cs0.23.101-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CodeMirror is a versatile text editor implemented in JavaScript for the browser. It is widely used for code editing in web applications due to its rich features such as syntax highlighting, code folding, and customizable themes. However, certain versions of CodeMirror are susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability, which can degrade performance and lead to application downtime.
Vulnerability Detail
CVE-2020-7760 is a ReDoS vulnerability affecting CodeMirror versions prior to 5.58.2. The vulnerability arises from a problematic regular expression located in the JavaScript mode of the CodeMirror library. The regex sub-pattern (s|/.?/) can cause excessive backtracking, leading to significant delays in processing input. This can be exploited by an attacker to craft specific inputs that trigger the regex, resulting in denial of service by consuming CPU resources and slowing down or crashing the application.
How To Fix
Minimum fixed version
5.58.2+~cs0.23.101-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade codemirror-jsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation to sanitize user inputs before they are processed by CodeMirror. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
CVE-2020-7760 is a significant vulnerability in the CodeMirror package that can lead to denial of service through regex exploitation. It is crucial to update to version 5.58.2 or later to mitigate this risk. Additionally, utilizing input validation can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for codemirror-js →
FAQ
CVE-2020-7760 is a vulnerability in the CodeMirror package that allows for Regular Expression Denial of Service (ReDoS) attacks due to a problematic regex pattern.
All versions of CodeMirror prior to 5.58.2 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to significant performance degradation, application slowdowns, or crashes, especially under heavy load or when processing malicious input.
Yes, you can implement input validation to sanitize user inputs before they are processed by CodeMirror, which can help reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for codemirror-js.
