What is GHSA-mmh6-m7v9-5956?

GHSA-mmh6-m7v9-5956 is a security advisory published by GitHub Security Advisories with Low severity. Regular expression denial of service in markdown-link-extractor

Which CVE IDs does GHSA-mmh6-m7v9-5956 cover?

GHSA-mmh6-m7v9-5956 covers the following CVE IDs: CVE-2021-43308. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-mmh6-m7v9-5956?

GHSA-mmh6-m7v9-5956 affects 2 products, including: npm/markdown-link-extractor:\u003c 3.0.2; npm/markdown-link-extractor:\u003e= 4.0.0, \u003c 4.0.1.

GHSA-mmh6-m7v9-5956Low

Regular expression denial of service in markdown-link-extractor

Vendor

GitHub Security Advisories

Published

June 3, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2021-43308 →

📋 Description

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbitrary input to the module's exported function

🎯 Affected products2

npm/markdown-link-extractor:< 3.0.2
npm/markdown-link-extractor:>= 4.0.0, < 4.0.1

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2021-43308
https://research.jfrog.com/vulnerabilities/markdown-link-extractor-redos-xray-211350/
https://github.com/advisories/GHSA-mmh6-m7v9-5956