Description

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbitrary input to the module's exported function

Remediation

References

https://research.jfrog.com/vulnerabilities/markdown-link-extractor-redos-xray-211350/

Related Vulnerabilities

CVE-2022-28156 Vulnerability in maven package com.surenpi.jenkins:phoenix-autotest

CVE-2022-23496 Vulnerability in maven package nl.basjes.parse.useragent:yauaa-drill

CVE-2020-14446 Vulnerability in maven package org.wso2.carbon.identity.framework:org.wso2.carbon.identity.entitlement.ui

CVE-2020-7740 Vulnerability in npm package node-pdf-generator

CVE-2022-25883 Vulnerability in npm package semver

Severity

High

Classification

CWE-1333 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Exploit Third Party Advisory