Skip to main content

Inefficient Regular Expression Complexity

CVE-2025-8262

Medium
5.3/10

Summary

A vulnerability was found in yarnpkg Yarn versions 1.8.0 and after. It has been classified as problematic. Affected is the function "explodeHostedGitFragment" of the file "src/resolvers/exotics/hosted-git-resolver.js". The manipulation leads to Inefficient Regular Rxpression complexity. It is possible to launch the attack remotely.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-1333 - Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

References

Advisory Timeline

  • Published