Regular Expression Denial Of Service (ReDoS)

2022-09-0704:48:01

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

shescape

vulnerability

redos

escapeargbash

unix.js

bash escaping

polynomial backtracking

quadratic runtime

application crash

software

EPSS

0.002

Percentile

54.3%

JSON

shescape is vulnerable to regular expression denial of service. The vulnerability exists in escapeArgBash function in unix.js due to insufficient regular expression complexity in bash escaping which allows an attacker to cause polynomial backtracking or quadratic runtime resulting an application crash.