What is GHSA-9fhw-r42p-5c7r?

GHSA-9fhw-r42p-5c7r is a security advisory published by GitHub Security Advisories with Medium severity. Regular expression Denial of Service in @progfay/scrapbox-parser

Which CVE IDs does GHSA-9fhw-r42p-5c7r cover?

GHSA-9fhw-r42p-5c7r covers the following CVE IDs: CVE-2021-27405. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9fhw-r42p-5c7r?

GHSA-9fhw-r42p-5c7r has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-9fhw-r42p-5c7r?

GHSA-9fhw-r42p-5c7r affects 2 products, including: npm/@progfay/scrapbox-parser:\u003c 6.0.3; npm/@progfay/scrapbox-parser:\u003e= 7.0.0, \u003c 7.0.2.

GHSA-9fhw-r42p-5c7rMediumCVSS 4.3

Regular expression Denial of Service in @progfay/scrapbox-parser

Vendor

GitHub Security Advisories

Published

March 1, 2021

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2021-27405 →

📋 Description

Impact

A Regular expression Denial of Service flaw was found in the @progfay/scrapbox-parser package before 6.0.3, 7.0.2 for Node.js. The attacker that is able to be parsed a specially crafted text may cause the application to consume an excessive amount of CPU.

Patches

Upgrade to version 6.0.3, 7.0.2 or later.

Workarounds

Avoid to parse text with a lot of [ chars.

References

https://github.com/progfay/scrapbox-parser/pull/519
https://github.com/progfay/scrapbox-parser/pull/539
https://github.com/progfay/scrapbox-parser/pull/540
https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-27405
https://snyk.io/vuln/SNYK-JS-PROGFAYSCRAPBOXPARSER-1076803

For more information

If you have any questions or comments about this advisory:

Open an issue in github.com/progfay/scrapbox-parser

🎯 Affected products2

npm/@progfay/scrapbox-parser:< 6.0.3
npm/@progfay/scrapbox-parser:>= 7.0.0, < 7.0.2