Stack Overflow Vulnerability in ESLint: Circular Reference Serialization Issue
Summary
GHSA-p5wg-g6qr-c7cg: eslint has a Stack Overflow when serializing objects with circular references. Affects eslint versions < 9.26.0. Fixed in 9.26.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ESLint is a widely-used open-source JavaScript linting utility that helps developers identify and fix problems in their JavaScript code. It provides a pluggable architecture, allowing users to create custom rules and configurations. However, prior to version 9.26.0, ESLint had a vulnerability that could lead to a Stack Overflow error when serializing objects with circular references, particularly during the validation of test cases.
Vulnerability Detail
The vulnerability arises from the RuleTester.run() method in ESLint, which is responsible for validating test cases and checking for duplicates. When an object with circular references is passed to the isSerializable() function during this process, it triggers infinite recursion, ultimately resulting in a Stack Overflow. This can lead to application crashes or denial of service, making it a significant concern for developers relying on ESLint for code quality.
How To Fix
Minimum fixed version
9.26.0
This is the first release that contains the fix.
npm install eslint@9.26.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid passing objects with circular references to the RuleTester.run() method until you can update to the patched version of ESLint. If you must test such objects, consider restructuring them to eliminate circular references.
Conclusion
The Stack Overflow vulnerability in ESLint due to circular reference serialization is a significant issue that can lead to application crashes. It is crucial for developers to update to version 9.26.0 or later to mitigate this risk. Additionally, using tools like Vulert can help monitor and manage open-source vulnerabilities effectively.
See every vulnerability recorded for eslint →
FAQ
The CVSS score of this vulnerability is 5.5, indicating a moderate severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Circular references occur when an object references itself directly or indirectly, creating a loop in the object graph. This can complicate serialization and lead to issues like Stack Overflow.
If you cannot update ESLint right away, avoid using circular reference objects in your test cases as a temporary measure until you can apply the update.
You can find more information about ESLint, including documentation and updates, on its official website at https://eslint.org.
References
Related vulnerabilities
Recent vulnerabilities recorded for eslint.
