Listen to this Post
How the CVE Works
The vulnerability exists in the `ConfigCommentParserparseJSONLikeConfig` API of @eslint/plugin-kit. The function uses a poorly optimized regular expression that lacks proper anchoring, making it susceptible to ReDoS attacks. When a maliciously crafted input string (e.g., a long sequence of repeated characters followed by specific symbols) is processed, the regex engine enters catastrophic backtracking, consuming excessive CPU resources and freezing the application. The issue stems from the unanchored grouped expression in packages/plugin-kit/src/config-comment-parser.js:158, which can be mitigated by prepending `[^-a-zA-Z0-9/]` to restrict input patterns.
DailyCVE Form
Platform: @eslint/plugin-kit
Version: <=0.3.3
Vulnerability: ReDoS
Severity: Medium
Date: 2023-07-21
Prediction: Patch by 2023-08-15
What Undercode Say
npm i @eslint/[email protected] node attack.js
const str = <code>${"A".repeat(1000000)}?: 1 B: 2</code>;
console.log(parser.parseJSONLikeConfig(str));
How Exploit
Craft a long string with repetitive characters and specific symbols to trigger regex backtracking, causing CPU exhaustion.
Protection from this CVE
Update to patched version.
Sanitize input.
Anchor regex patterns.
Impact
High CPU usage.
Application freeze.
Denial of Service.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
