Regular Expression Denial of Service in eslint
Summary
GHSA-jcgq-xh2f-2hfm: Regular Expression Denial of Service. Affects eslint versions < 4.18.2. Fixed in 4.18.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
eslint is a popular open-source JavaScript linting utility that helps identify and report patterns in JavaScript code. It is widely used to enforce coding standards and catch potential errors. However, eslint versions before 4.18.2 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack. This vulnerability arises from a regex pattern in eslint that is susceptible to catastrophic backtracking.
Vulnerability Detail
The vulnerability in eslint allows an attacker to exploit the regex pattern and cause the application to enter into a state of exponential time complexity. By providing specially crafted input, an attacker can force the regex engine to spend an excessive amount of time evaluating the pattern, leading to a denial of service condition. This can result in a significant impact on the availability and performance of the affected application.
How To Fix
Minimum fixed version
4.18.2
This is the first release that contains the fix.
npm install eslint@4.18.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of eslint to mitigate the risk of exploitation.
Conclusion
In conclusion, the vulnerability in eslint versions before 4.18.2 exposes applications to a Regular Expression Denial of Service (ReDoS) attack. To mitigate this risk, it is crucial to update to the fixed version of eslint. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for eslint →
FAQ
eslint is a JavaScript linting utility that helps identify and report patterns in JavaScript code. It is widely used to enforce coding standards and catch potential errors.
A Regular Expression Denial of Service (ReDoS) attack is a type of vulnerability where an attacker can exploit a regex pattern to cause the application to enter into a state of exponential time complexity, leading to a denial of service condition.
Catastrophic backtracking occurs when a regex pattern contains ambiguous constructs that can result in exponential time complexity during evaluation. This can be exploited by an attacker to cause a denial of service condition.
This vulnerability can lead to a denial of service condition, impacting the availability and performance of the affected application.
To fix this vulnerability, it is recommended to upgrade to eslint version 4.18.2 or later. Updating to the latest version ensures that the vulnerable regex pattern is patched and no longer susceptible to ReDoS attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for eslint.
