@tarojs/rn-runner (>=4.0.0-alpha.0, <=4.1.1), @tarojs/rn-style-transformer (>=4.0.0-alpha.0, <=4.1.1) +2 more potentially affected by CVE-2025-5896 via taro-css-to-react-native (>=4.0.0, <=4.1.1-alpha.2)

taro-css-to-react-native NPM version =4.0.0, =4.0.0-alpha.0, =4.0.0-alpha.0, =4.0.0-alpha.0, =4.0.0-alpha.0, =4.1.1 Source cves: CVE-2025-5896 Source advisory: OSV:GHSA-F5XG-CFPJ-2MW6...

CVE-2025-5896

A vulnerability was found in tarojs taro up to 4.1.1. It has been declared as problematic. This vulnerability affects unknown code of the file taro/packages/css-to-react-native/src/index.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely...

CVE-2025-5896 tarojs taro index.js redos

A vulnerability was found in tarojs taro up to 4.1.1. It has been declared as problematic. This vulnerability affects unknown code of the file taro/packages/css-to-react-native/src/index.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely...