GHSA-hhfg-6hfc-rvxmMediumCVSS 5.3

Regular Expression Denial of Service in jsoneditor

Published
September 29, 2021
Last Modified
February 12, 2025

🔗 CVE IDs covered (1)

📋 Description

JSON Editor is a web-based tool to view, edit, format, and validate JSON. It has various modes such as a tree editor, a code editor, and a plain text editor. The jsoneditor package is vulnerable to ReDoS (regular expression denial of service). An attacker that is able to provide a crafted element as input to the getInnerText function may cause an application to consume an excessive amount of CPU. Below pinned line using vulnerable regex.

🎯 Affected products1

  • npm/jsoneditor:< 9.5.6

🔗 References (4)