Incorrect Regular Expression in eslint

Cx37ebdf56-bc4d

eslint

Medium

5.9/10

Summary

eslint before 4.18.2 suffers from a potential O(n^2) catastrophic backtracking behavior.

Attack Complexity: HIGH
Attack Vector: NETWORK
Integrity Impact: NONE
Scope: UNCHANGED
User Interaction: NONE
Privileges Required: NONE
Confidentiality Impact: NONE
Availability Impact: HIGH

CWE-185 - Incorrect Regular Expression

The software specifies a regular expression in a way that causes data to be improperly matched or compared.

References

Advisory Timeline

Published Feb 22, 2018