Skip to main content

Inefficient Regular Expression Complexity in org.webjars.bowergithub.vuejs:vue

CVE-2024-9506

  • org.webjars.bowergithub.vuejs:vue
  • org.webjars.bower:vue
  • org.webjars.npm:vue
  • org.webjars.npm:vue-server-renderer
  • org.webjars.npm:vue-template-compiler
  • org.webjars:vue
  • vue
  • @vue/compiler-sfc
  • vue-server-renderer
  • vue-template-compiler
Low
3.7/10

Summary

Improper regular expression in Vue's "parseHTML" function leads to a potential Regular Expression Denial of Service vulnerability. This issue affects vue versions 2.0.0-alpha.1 prior to 3.0.0-alpha.0, @vue/compiler-sfc versions 2.7.0-alpha.1 through 2.7.16, vue-server-renderer versions 2.0.0-beta.1 through 2.7.16, and vue-template-compiler versions 0.1.0 through 2.7.16.

  • HIGH
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • LOW

CWE-1333 - Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

References

Advisory Timeline

  • Published