Vulnerability · Published Jan 11, 2023 · Assigned by VulDB
CVE-2020-36649mholt PapaParse papaparse.js redos
Low 3.5
In plain English
A low-severity regular-expression denial of service in PapaParse from mholt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A vulnerability was found in mholt PapaParse up to 5.1.x. It has been classified as problematic. Affected is an unknown function of the file papaparse.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 5.2.0 is able to address this issue. The name of the patch is 235a12758cd77266d2e98fd715f53536b34ad621. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218004.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | mediawiki | 1:1.39.4-1~deb12u1 | DEBIAN-CVE-2020-36649 |
| Debian:13 | mediawiki | 1:1.39.4-1 | DEBIAN-CVE-2020-36649 |
| Debian:14 | mediawiki | 1:1.39.4-1 | DEBIAN-CVE-2020-36649 |
| Ubuntu:25.10 | mediawiki | no fix listed | UBUNTU-CVE-2020-36649 |
| Ubuntu:26.04:LTS | mediawiki | no fix listed | UBUNTU-CVE-2020-36649 |
| Ubuntu:26.10 | mediawiki | no fix listed | UBUNTU-CVE-2020-36649 |
| npm | papaparse | 5.2.0 | GHSA-qvjc-g5vr-mfgr |
Affected products (as reported)
Weakness: CWE-1333 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
References
- https://vuldb.com/?id.218004 vdb-entry, technical-description
- https://vuldb.com/?ctiid.218004 signature, permissions-required
- https://github.com/mholt/PapaParse/issues/777 issue-tracking
- https://github.com/mholt/PapaParse/pull/779 issue-tracking
- https://github.com/mholt/PapaParse/commit/235a12758cd77266d2e98fd715f53536b34ad621 patch
- https://github.com/mholt/PapaParse/releases/tag/5.2.0 patch