Regular Expression Denial Of Service (ReDoS)

2020-10-1406:25:14

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

45.9%

JSON

dat.gui is vulnerable to regular expression denial of service. The sub-pattern \s*(.+)\s* in interpret.js and can be exploited to cause a denial of service.

CPENameOperatorVersion
dat.guile0.7.7
dat.guieq0.5
dat.guile0.5.1

Name	Operator	Version
dat.gui	le	0.7.7
dat.gui	eq	0.5
dat.gui	le	0.5.1

References

github.com/dataarts/dat.gui/blob/v0.7.7/src/dat/color/interpret.js#L60

github.com/dataarts/dat.gui/blob/v0.7.7/src/dat/color/interpret.js#L78

github.com/dataarts/dat.gui/issues/278

github.com/dataarts/dat.gui/pull/279

0.001 Low

EPSS

Percentile

45.9%

JSON

Related for VERACODE:27577