mholt/papaparse · Security
Regular Expression Denial of Service in papaparse
- GHSA ID
- GHSA-qvjc-g5vr-mfgr
- CVE ID
- CVE-2020-36649
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
Versions of papaparse prior to 5.2.0 are vulnerable to Regular Expression Denial of Service (ReDos). The parse function contains a malformed regular expression that takes exponentially longer to process non-numerical inputs. This allows attackers to stall systems and lead to Denial of Service.
Recommendation
Upgrade to version 5.2.0 or later.
CWEs
- CWE-185 · Incorrect Regular Expression
References
- https://github.com/mholt/PapaParse/issues/777 ↗
- https://snyk.io/vuln/SNYK-JS-PAPAPARSE-564258 ↗
- https://github.com/mholt/PapaParse/commit/235a12758cd77266d2e98fd715f53536b34ad621 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2020-36649 ↗
- https://github.com/mholt/PapaParse/pull/779 ↗
- https://github.com/mholt/PapaParse/releases/tag/5.2.0 ↗
- https://vuldb.com/?ctiid.218004 ↗
- https://vuldb.com/?id.218004 ↗
- https://github.com/advisories/GHSA-qvjc-g5vr-mfgr ↗