GHSA-qvjc-g5vr-mfgrHighCVSS 7.5
Regular Expression Denial of Service in papaparse
🔗 CVE IDs covered (1)
📋 Description
Versions of papaparse prior to 5.2.0 are vulnerable to Regular Expression Denial of Service (ReDos). The parse function contains a malformed regular expression that takes exponentially longer to process non-numerical inputs. This allows attackers to stall systems and lead to Denial of Service.
Recommendation
Upgrade to version 5.2.0 or later.
🎯 Affected products1
- npm/papaparse:< 5.2.0
🔗 References (9)
- https://github.com/mholt/PapaParse/issues/777
- https://snyk.io/vuln/SNYK-JS-PAPAPARSE-564258
- https://github.com/mholt/PapaParse/commit/235a12758cd77266d2e98fd715f53536b34ad621
- https://nvd.nist.gov/vuln/detail/CVE-2020-36649
- https://github.com/mholt/PapaParse/pull/779
- https://github.com/mholt/PapaParse/releases/tag/5.2.0
- https://vuldb.com/?ctiid.218004
- https://vuldb.com/?id.218004
- https://github.com/advisories/GHSA-qvjc-g5vr-mfgr