CVE-2023-30858 Denosaurs emoji has ReDoS vulnerability in `replace` function

The Denosaurs emoji package provides emojis for dinosaurs. Starting in version 0.1.0 and prior to version 0.3.0, the reTrimSpace regex has 2nd degree polynomial inefficiency, leading to a delayed response given a big payload. The issue has been patched in 0.3.0. As a workaround, avoid using the...

emoji 安全漏洞

emoji is a simple emoticon from the Denosaurs team that supports the node.js project. A security vulnerability exists in Denosaurs emoji version 0.1.0 up to and including version 0.3.0, which stems from an inefficient second-order polynomial in a regular expression, resulting in a delayed respons...

ReDoS vulnerability in `strip` function

Description The reTrimSpace regex has 2nd degree polynomial inefficiency, leading to a delayed response given a big payload. Proof of Concept import as emoji from "https://deno.land/x/[email protected]/mod.ts"; const input = '\x00' + '\t'.repeat154773 + '\t\x00'; const start = performance.now;...

PT-2023-11361 · Unknown · Simple-Markdown

Name of the Vulnerable Software and Affected Versions: simple-markdown version 0.5.1 Description: A vulnerability has been found in the simple-markdown software, affecting an unknown functionality of the file simple-markdown.js. The manipulation leads to inefficient regular expression complexity...

PT-2023-10820 · Segmentio · Is-Url

Name of the Vulnerable Software and Affected Versions: Segmentio is-url versions up to 1.2.2 Description: A vulnerability was found in the file index.js, leading to inefficient regular expression complexity. The attack may be launched remotely. Recommendations: For versions up to 1.2.2, upgrade t...

UBUNTU-CVE-2020-36649

A vulnerability was found in mholt PapaParse up to 5.1.x. It has been classified as problematic. Affected is an unknown function of the file papaparse.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 5.2.0 is able to address this issue. The name of the...

CVE-2020-26302

is.js is a general-purpose check library. Versions 0.9.0 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service ReDoS. is.js uses a regex copy-pasted from a gist to validate URLs. Trying to validate a malicious string can cause the regex to...