Vulnerability-Lookup

GHSA-59P9-H35M-WG4G

Vulnerability from github – Published: 2025-09-12 12:30 – Updated: 2025-09-15 13:57

Summary

Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer

Details

A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer's remove_language_code() method. This vulnerability is present in version 4.52.4 and has been fixed in version 4.53.0. The issue arises from inefficient regex processing, which can be exploited by crafted input strings containing malformed language code patterns, leading to excessive CPU consumption and potential denial of service.

Severity

5.3 (Medium)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "transformers"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.53.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-6638"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-09-15T13:57:49Z",
    "nvd_published_at": "2025-09-12T11:15:31Z",
    "severity": "MODERATE"
  },
  "details": "A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer\u0027s `remove_language_code()` method. This vulnerability is present in version 4.52.4 and has been fixed in version 4.53.0. The issue arises from inefficient regex processing, which can be exploited by crafted input strings containing malformed language code patterns, leading to excessive CPU consumption and potential denial of service.",
  "id": "GHSA-59p9-h35m-wg4g",
  "modified": "2025-09-15T13:57:49Z",
  "published": "2025-09-12T12:30:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6638"
    },
    {
      "type": "WEB",
      "url": "https://github.com/huggingface/transformers/commit/47c34fba5c303576560cb29767efb452ff12b8be"
    },
    {
      "type": "WEB",
      "url": "https://github.com/huggingface/transformers/commit/d37f7517972f67e3f2194c000ed0f87f064e5099"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/huggingface/transformers"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/6a6c933f-9ce8-4ded-8b3b-2c1444c61f36"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer"
}

GHSA-5G3J-89FR-R2VP

Vulnerability from github – Published: 2026-04-08 00:07 – Updated: 2026-04-08 00:07

Summary

skilleton has improper input handling in repository/path processing

Details

Summary

skilleton versions prior to 0.3.1 include security-related weaknesses in repository normalization and path handling logic.
Version 0.3.1 contains fixes and additional test coverage for these issues.

Affected Versions

<0.3.1

Patched Versions

>=0.3.1

Impact

In affected versions, crafted input could trigger unsafe or inefficient behavior in repository/path processing code paths.
0.3.1 mitigates this by: - replacing vulnerable parsing behavior with deterministic logic, - validating subpaths earlier before allocating git worktree resources, - adding stricter and broader regression tests around these flows.

Severity

Low to Moderate (project-maintainer assessed)

Mitigation

Upgrade to 0.3.1 or later.

Workarounds

No complete workaround is recommended other than upgrading.

References

Branch: fix/security-code-scanning-alerts
Commits:
fix(security): harden git arg handling and path validation
fix(security): use while loop in normalizeRepoUrl instead of regex
Security Policy: SECURITY.md

Credits

Detected through automated code scanning and remediated by project maintainers.

Severity

6.9 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "skilleton"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333",
      "CWE-400",
      "CWE-78",
      "CWE-88"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-08T00:07:36Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\n`skilleton` versions prior to `0.3.1` include security-related weaknesses in repository normalization and path handling logic.  \nVersion `0.3.1` contains fixes and additional test coverage for these issues.\n\n## Affected Versions\n\n`\u003c0.3.1`\n\n## Patched Versions\n\n`\u003e=0.3.1`\n\n## Impact\n\nIn affected versions, crafted input could trigger unsafe or inefficient behavior in repository/path processing code paths.  \n`0.3.1` mitigates this by:\n- replacing vulnerable parsing behavior with deterministic logic,\n- validating subpaths earlier before allocating git worktree resources,\n- adding stricter and broader regression tests around these flows.\n\n## Severity\n\nLow to Moderate (project-maintainer assessed)\n\n## Mitigation\n\nUpgrade to `0.3.1` or later.\n\n## Workarounds\n\nNo complete workaround is recommended other than upgrading.\n\n## References\n\n- Branch: [`fix/security-code-scanning-alerts`](https://github.com/Fcmam5/skilleton/pull/9)\n- Commits:\n  - [fix(security): harden git arg handling and path validation](https://github.com/Fcmam5/skilleton/pull/9/changes/42bc280ad675bfaa7b1bbc192330fb582bb28172)\n  - [fix(security): use while loop in normalizeRepoUrl instead of regex](https://github.com/Fcmam5/skilleton/pull/9/changes/6613160803ec8655efee9a270eeaa767ad22da8b)\n- Security Policy: [SECURITY.md](https://github.com/Fcmam5/skilleton/blob/master/SECURITY.md)\n\n## Credits\n\nDetected through automated code scanning and remediated by project maintainers.",
  "id": "GHSA-5g3j-89fr-r2vp",
  "modified": "2026-04-08T00:07:36Z",
  "published": "2026-04-08T00:07:36Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Fcmam5/skilleton/security/advisories/GHSA-5g3j-89fr-r2vp"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Fcmam5/skilleton/pull/9/changes/42bc280ad675bfaa7b1bbc192330fb582bb28172"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Fcmam5/skilleton/pull/9/changes/6613160803ec8655efee9a270eeaa767ad22da8b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Fcmam5/skilleton"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "skilleton has improper input handling in repository/path processing"
}

GHSA-5J4C-8P2G-V4JX

Vulnerability from github – Published: 2024-10-15 18:30 – Updated: 2024-10-24 18:42

Summary

ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function

Details

The ReDoS can be exploited through the parseHTML function in the html-parser.ts file. This flaw allows attackers to slow down the application by providing specially crafted input that causes inefficient processing of regular expressions, leading to excessive resource consumption.

To demonstrate this vulnerability, here's an example. In a Vue client-side application, create a new Vue instance with a template string that includes a <script> tag but closes it incorrectly with something like </textarea>.

new Vue({
  el: '#app',
  template: '
    <div>
      Hello, world!
      <script>${'<'.repeat(1000000)}</textarea>
    </div>'
});

Next, set up a basic HTML page (e.g., index.html) to load this JavaScript and mount the Vue instance:

<!DOCTYPE html>
<html>
<head>
  <title>My first Vue app</title>
</head>
<body>
  <div id=\"app\">Loading...</div>
</body>
</html>

When you visit the app in your browser at http://localhost:3000, you'll notice that the time taken to parse and mount the Vue application increases significantly due to the ReDoS vulnerability, demonstrating how the flaw can affect performance.

Severity

3.7 (Low)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

2.9 (Low)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "vue"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0-alpha.1"
            },
            {
              "fixed": "3.0.0-alpha.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-9506"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-10-24T18:42:59Z",
    "nvd_published_at": "2024-10-15T16:15:06Z",
    "severity": "LOW"
  },
  "details": "The ReDoS can be exploited through the `parseHTML` function in the `html-parser.ts` file. This flaw allows attackers to slow down the application by providing specially crafted input that causes inefficient processing of regular expressions, leading to excessive resource consumption.\n\nTo demonstrate this vulnerability, here\u0027s an example. In a Vue client-side application, create a new Vue instance with a template string that includes a `\u003cscript\u003e` tag but closes it incorrectly with something like `\u003c/textarea\u003e`.\n\n```javascript\nnew Vue({\n  el: \u0027#app\u0027,\n  template: \u0027\n    \u003cdiv\u003e\n      Hello, world!\n      \u003cscript\u003e${\u0027\u003c\u0027.repeat(1000000)}\u003c/textarea\u003e\n    \u003c/div\u003e\u0027\n});\n```\nNext, set up a basic HTML page (e.g., index.html) to load this JavaScript and mount the Vue instance:\n\n```html\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\u003chead\u003e\n  \u003ctitle\u003eMy first Vue app\u003c/title\u003e\n\u003c/head\u003e\n\u003cbody\u003e\n  \u003cdiv id=\\\"app\\\"\u003eLoading...\u003c/div\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n```\n\nWhen you visit the app in your browser at http://localhost:3000, you\u0027ll notice that the time taken to parse and mount the Vue application increases significantly due to the ReDoS vulnerability, demonstrating how the flaw can affect performance.",
  "id": "GHSA-5j4c-8p2g-v4jx",
  "modified": "2024-10-24T18:42:59Z",
  "published": "2024-10-15T18:30:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9506"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vuejs/core"
    },
    {
      "type": "WEB",
      "url": "https://www.herodevs.com/vulnerability-directory/cve-2024-9506"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function"
}

GHSA-5JFM-FVC2-73XF

Vulnerability from github – Published: 2023-08-02 03:30 – Updated: 2024-04-04 06:29

Details

An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use ProjectReferenceFilter to the preview_markdown endpoint.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-3994"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333",
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-08-02T01:15:09Z",
    "severity": "HIGH"
  },
  "details": "An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use ProjectReferenceFilter to the preview_markdown endpoint.",
  "id": "GHSA-5jfm-fvc2-73xf",
  "modified": "2024-04-04T06:29:26Z",
  "published": "2023-08-02T03:30:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3994"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/1963255"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/416225"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-5JHF-FPP7-V2PV

Vulnerability from github – Published: 2026-08-25 18:31 – Updated: 2026-09-02 14:43

Withdrawn 2026-09-02

Summary

Duplicate Advisory: Nokogiri CSS selector tokenizer has regular expression backtracking

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-c4rq-3m3g-8wgx. This link is maintained to preserve external references.

Original Description

Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Node#css, Node#at_css, and Searchable#search to cause exponential regex backtracking and denial of service.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

8.7 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 1.19.3"
      },
      "package": {
        "ecosystem": "RubyGems",
        "name": "nokogiri"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-02T14:43:13Z",
    "nvd_published_at": "2026-08-25T16:17:28Z",
    "severity": "HIGH"
  },
  "details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-c4rq-3m3g-8wgx. This link is maintained to preserve external references.\n\n## Original Description\nNokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Node#css, Node#at_css, and Searchable#search to cause exponential regex backtracking and denial of service.",
  "id": "GHSA-5jhf-fpp7-v2pv",
  "modified": "2026-09-02T14:43:13Z",
  "published": "2026-08-25T18:31:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-c4rq-3m3g-8wgx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79770"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/nokogiri-before-redos-via-css-selector-tokenizer"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Duplicate Advisory: Nokogiri CSS selector tokenizer has regular expression backtracking",
  "withdrawn": "2026-09-02T14:43:13Z"
}

GHSA-5JQP-885W-XJ32

Vulnerability from github – Published: 2022-11-10 12:01 – Updated: 2023-08-31 00:33

Summary

pymatgen is vulnerable to Regular Expression Denial of Service (ReDoS)

Details

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the pymatgen PyPI package, when an attacker is able to supply arbitrary input to the GaussianInput.from_string method.

Severity

5.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pymatgen"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2022.9.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-42964"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-11-10T18:55:00Z",
    "nvd_published_at": "2022-11-09T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the pymatgen PyPI package, when an attacker is able to supply arbitrary input to the `GaussianInput.from_string` method.",
  "id": "GHSA-5jqp-885w-xj32",
  "modified": "2023-08-31T00:33:18Z",
  "published": "2022-11-10T12:01:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42964"
    },
    {
      "type": "WEB",
      "url": "https://github.com/materialsproject/pymatgen/issues/2755"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/materialsproject/pymatgen"
    },
    {
      "type": "WEB",
      "url": "https://research.jfrog.com/vulnerabilities/pymatgen-redos-xray-257184"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "pymatgen is vulnerable to Regular Expression Denial of Service (ReDoS)"
}

GHSA-5M38-526F-3498

Vulnerability from github – Published: 2026-09-29 21:33 – Updated: 2026-10-01 18:32

Details

crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains polynomial-time regular expression denial-of-service conditions in think-tag response parsing on Ruby 3.1.x. A malicious or anomalous model response containing many unterminated tags can cause excessive CPU consumption in two consecutive regular expressions and delay chat-completion processing

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-67987"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-29T20:17:22Z",
    "severity": "HIGH"
  },
  "details": "crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains polynomial-time regular expression denial-of-service conditions in think-tag response parsing on Ruby 3.1.x. A malicious or anomalous model response containing many unterminated \u003cthink\u003e tags can cause excessive CPU consumption in two consecutive regular expressions and delay chat-completion processing",
  "id": "GHSA-5m38-526f-3498",
  "modified": "2026-10-01T18:32:41Z",
  "published": "2026-09-29T21:33:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67987"
    },
    {
      "type": "WEB",
      "url": "https://github.com/crmne/ruby_llm/commit/5e88411f171721b381853fa77d254e266dcf6ad8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/crmne/ruby_llm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/crmne/ruby_llm/blob/fa6f279847d6d7027814539d9c0dfc3bbdfd2a83/lib/ruby_llm/protocols/chat_completions/chat.rb#L355-L356"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-5PGG-2G8V-P4X9

Vulnerability from github – Published: 2024-04-05 06:30 – Updated: 2025-09-19 15:23

Summary

SheetJS Regular Expression Denial of Service (ReDoS)

Details

SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service (ReDoS).

A non-vulnerable version cannot be found via npm, as the repository hosted on GitHub and the npm package xlsx are no longer maintained. Version 0.20.2 can be downloaded via https://cdn.sheetjs.com/.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 0.20.2"
      },
      "package": {
        "ecosystem": "npm",
        "name": "xlsx"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-22363"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-08T13:47:03Z",
    "nvd_published_at": "2024-04-05T06:15:10Z",
    "severity": "HIGH"
  },
  "details": "SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service (ReDoS).\n\nA non-vulnerable version cannot be found via npm, as the repository hosted on GitHub and the npm package `xlsx` are no longer maintained. Version 0.20.2 can be downloaded via https://cdn.sheetjs.com/.",
  "id": "GHSA-5pgg-2g8v-p4x9",
  "modified": "2025-09-19T15:23:24Z",
  "published": "2024-04-05T06:30:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22363"
    },
    {
      "type": "WEB",
      "url": "https://cdn.sheetjs.com"
    },
    {
      "type": "WEB",
      "url": "https://cdn.sheetjs.com/advisories/CVE-2024-22363"
    },
    {
      "type": "WEB",
      "url": "https://cwe.mitre.org/data/definitions/1333.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.sheetjs.com/sheetjs/sheetjs"
    },
    {
      "type": "WEB",
      "url": "https://git.sheetjs.com/sheetjs/sheetjs/src/tag/v0.20.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SheetJS Regular Expression Denial of Service (ReDoS)"
}

GHSA-5Q95-HRPC-M3W3

Vulnerability from github – Published: 2026-09-23 18:12 – Updated: 2026-09-23 18:12

Summary

JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable

Details

Summary

The JLine3 HISTORY_IGNORE variable is converted into a Java regular expression with only partial escaping. As a result, regex metacharacters other than * and : are passed through to the regex engine. A crafted value such as (a+)+b can cause catastrophic backtracking each time a command line is added to history, hanging the reader thread at high CPU.

Details

In reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java, matchPatterns() converts HISTORY_IGNORE into a regex:

for (int i = 0; i < patterns.length(); i++) {
    char ch = patterns.charAt(i);
    if (ch == '\\') {
        ch = patterns.charAt(++i);
        sb.append(ch);
    } else if (ch == ':') {
        sb.append('|');
    } else if (ch == '*') {
        sb.append('.').append('*');
    } else {
        sb.append(ch);
    }
}
return line.matches(sb.toString());

This logic translates wildcard syntax but does not escape regex metacharacters such as (, ), +, ?, {, }, [, and ]. Those characters therefore reach the Java regex engine unchanged.

Affected source location: - reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java - matchPatterns(String patterns, String line)

PoC

Configure HISTORY_IGNORE to a malicious pattern, for example:

set history-ignore "(a+)+b"

At the JLine prompt, enter a long non-matching line:

aaaaaaaaaaaaaaaaaaaaaaaaaaax

Press Enter.

Expected result: - The prompt does not return. - The reader thread consumes high CPU.

Reproduction environment: - JLine3 on x86_64 Linux - OpenJDK 25.0.2

Impact

This is a denial-of-service vulnerability caused by catastrophic regex backtracking. Applications embedding org.jline:jline-reader are impacted if they allow HISTORY_IGNORE to be configured through user configuration or application settings. The issue is lower severity than the interactive editor findings because the attacker must control configuration, but it can still reliably hang a reader session.

Suggested Fix

The safest fix for the current git head is to stop treating arbitrary HISTORY_IGNORE content as a regex. Instead, escape all characters by default and translate only the intended JLine wildcard syntax (*) and separator syntax (:).

Suggested patch:

diff --git a/reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java b/reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java
--- a/reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java
+++ b/reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java
@@
         StringBuilder sb = new StringBuilder();
         for (int i = 0; i < patterns.length(); i++) {
             char ch = patterns.charAt(i);
             if (ch == '\\') {
                 ch = patterns.charAt(++i);
-                sb.append(ch);
+                sb.append(Pattern.quote(Character.toString(ch)));
             } else if (ch == ':') {
                 sb.append('|');
             } else if (ch == '*') {
                 sb.append('.').append('*');
             } else {
-                sb.append(ch);
+                sb.append(Pattern.quote(Character.toString(ch)));
             }
         }
         return line.matches(sb.toString());

Credits

This issue was identified by Michał Majchrowicz and Marcin Wyczechowski, members of the AFINE Team.

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.jline:jline-reader"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.jline:jline-reader"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.30.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-77420"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-23T18:12:05Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nThe JLine3 `HISTORY_IGNORE` variable is converted into a Java regular expression with\nonly partial escaping. As a result, regex metacharacters other than `*` and `:` are\npassed through to the regex engine. A crafted value such as `(a+)+b` can cause\ncatastrophic backtracking each time a command line is added to history, hanging the\nreader thread at high CPU.\n\n### Details\n\nIn `reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java`,\n`matchPatterns()` converts `HISTORY_IGNORE` into a regex:\n\n```java\nfor (int i = 0; i \u003c patterns.length(); i++) {\n    char ch = patterns.charAt(i);\n    if (ch == \u0027\\\\\u0027) {\n        ch = patterns.charAt(++i);\n        sb.append(ch);\n    } else if (ch == \u0027:\u0027) {\n        sb.append(\u0027|\u0027);\n    } else if (ch == \u0027*\u0027) {\n        sb.append(\u0027.\u0027).append(\u0027*\u0027);\n    } else {\n        sb.append(ch);\n    }\n}\nreturn line.matches(sb.toString());\n```\n\nThis logic translates wildcard syntax but does not escape regex metacharacters such as\n`(`, `)`, `+`, `?`, `{`, `}`, `[`, and `]`. Those characters therefore reach the Java\nregex engine unchanged.\n\nAffected source location:\n- `reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java`\n- `matchPatterns(String patterns, String line)`\n\n### PoC\n\n1. Configure `HISTORY_IGNORE` to a malicious pattern, for example:\n\n```sh\nset history-ignore \"(a+)+b\"\n```\n\n2. At the JLine prompt, enter a long non-matching line:\n\n```text\naaaaaaaaaaaaaaaaaaaaaaaaaaax\n```\n\n3. Press Enter.\n\nExpected result:\n- The prompt does not return.\n- The reader thread consumes high CPU.\n\nReproduction environment:\n- JLine3 on x86_64 Linux\n- OpenJDK 25.0.2\n\n### Impact\n\nThis is a denial-of-service vulnerability caused by catastrophic regex backtracking.\nApplications embedding `org.jline:jline-reader` are impacted if they allow\n`HISTORY_IGNORE` to be configured through user configuration or application settings.\nThe issue is lower severity than the interactive editor findings because the attacker\nmust control configuration, but it can still reliably hang a reader session.\n\n### Suggested Fix\n\nThe safest fix for the current git head is to stop treating arbitrary `HISTORY_IGNORE`\ncontent as a regex. Instead, escape all characters by default and translate only the\nintended JLine wildcard syntax (`*`) and separator syntax (`:`).\n\nSuggested patch:\n\n```diff\ndiff --git a/reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java b/reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java\n--- a/reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java\n+++ b/reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java\n@@\n         StringBuilder sb = new StringBuilder();\n         for (int i = 0; i \u003c patterns.length(); i++) {\n             char ch = patterns.charAt(i);\n             if (ch == \u0027\\\\\u0027) {\n                 ch = patterns.charAt(++i);\n-                sb.append(ch);\n+                sb.append(Pattern.quote(Character.toString(ch)));\n             } else if (ch == \u0027:\u0027) {\n                 sb.append(\u0027|\u0027);\n             } else if (ch == \u0027*\u0027) {\n                 sb.append(\u0027.\u0027).append(\u0027*\u0027);\n             } else {\n-                sb.append(ch);\n+                sb.append(Pattern.quote(Character.toString(ch)));\n             }\n         }\n         return line.matches(sb.toString());\n```\n\n### Credits\n\nThis issue was identified by Micha\u0142 Majchrowicz and Marcin Wyczechowski, members of the AFINE Team.",
  "id": "GHSA-5q95-hrpc-m3w3",
  "modified": "2026-09-23T18:12:06Z",
  "published": "2026-09-23T18:12:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jline/jline3/security/advisories/GHSA-5q95-hrpc-m3w3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jline/jline3/pull/2012"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jline/jline3/pull/2018"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jline/jline3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jline/jline3/releases/tag/4.3.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jline/jline3/releases/tag/jline-3.30.15"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable"
}

GHSA-5V2H-R2CX-5XGJ

Vulnerability from github – Published: 2022-01-14 21:04 – Updated: 2022-01-14 19:57

Summary

Inefficient Regular Expression Complexity in marked

Details

Impact

What kind of vulnerability is it?

Denial of service.

The regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings. PoC is the following.

import * as marked from 'marked';

console.log(marked.parse(`[x]: x

\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](`));

Who is impacted?

Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.

Patches

Has the problem been patched?

Yes

What versions should users upgrade to?

4.0.10

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.

References

Are there any links users can visit to find out more?

https://marked.js.org/using_advanced#workers
https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS

For more information

If you have any questions or comments about this advisory:

Open an issue in marked

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "marked"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.0.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-21681"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-01-14T19:57:17Z",
    "nvd_published_at": "2022-01-14T17:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\n_What kind of vulnerability is it?_\n\nDenial of service.\n\nThe regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings.\nPoC is the following.\n\n```javascript\nimport * as marked from \u0027marked\u0027;\n\nconsole.log(marked.parse(`[x]: x\n\n\\\\[\\\\](\\\\[\\\\](\\\\[\\\\](\\\\[\\\\](\\\\[\\\\](\\\\[\\\\](\\\\[\\\\](\\\\[\\\\](\\\\[\\\\](\\\\[\\\\](\\\\[\\\\](\\\\[\\\\](\\\\[\\\\](\\\\[\\\\](\\\\[\\\\](\\\\[\\\\](\\\\[\\\\](\\\\[\\\\](\\\\[\\\\](\\\\[\\\\](\\\\[\\\\](\\\\[\\\\](\\\\[\\\\](\\\\[\\\\](\\\\[\\\\](\\\\[\\\\](\\\\[\\\\](\\\\[\\\\](\\\\[\\\\](\\\\[\\\\](`));\n```\n\n_Who is impacted?_\n\nAnyone who runs untrusted markdown through marked and does not use a worker with a time limit.\n\n### Patches\n\n_Has the problem been patched?_\n\nYes\n\n_What versions should users upgrade to?_\n\n4.0.10\n\n### Workarounds\n\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nDo not run untrusted markdown through marked or run marked on a [worker](https://marked.js.org/using_advanced#workers) thread and set a reasonable time limit to prevent draining resources.\n\n### References\n\n_Are there any links users can visit to find out more?_\n\n- https://marked.js.org/using_advanced#workers\n- https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [marked](https://github.com/markedjs/marked)\n",
  "id": "GHSA-5v2h-r2cx-5xgj",
  "modified": "2022-01-14T19:57:17Z",
  "published": "2022-01-14T21:04:46Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/markedjs/marked/security/advisories/GHSA-5v2h-r2cx-5xgj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21681"
    },
    {
      "type": "WEB",
      "url": "https://github.com/markedjs/marked/commit/8f806573a3f6c6b7a39b8cdb66ab5ebb8d55a5f5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/markedjs/marked/commit/c4a3ccd344b6929afa8a1d50ac54a721e57012c0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/markedjs/marked"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AIXDMC3CSHYW3YWVSQOXAWLUYQHAO5UX"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Inefficient Regular Expression Complexity in marked"
}

CWE-1333

Inefficient Regular Expression Complexity

Summary

Affected Versions

Patched Versions

Impact

Severity

Mitigation

Workarounds

References

Credits

Duplicate Advisory

Original Description

Summary

Details

PoC

Impact

Suggested Fix

Credits

Impact

Patches

Workarounds

References

For more information

Mitigation

Mitigation

Mitigation

Mitigation

CAPEC-492: Regular Expression Exponential Blowup