Vulnerability · Published Nov 19, 2024 · Assigned by snyk
CVE-2024-21539
High 7.5
In plain English
A high-severity regular-expression denial of service in @eslint/plugin-kit. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 56.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Versions of the package @eslint/plugin-kit before 0.2.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by exploiting this vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @eslint/plugin-kit | 0.2.3 | GHSA-7q7g-4xm8-89cq |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | @eslint/plugin-kit | 0 – before 0.2.3 |
Weakness: CWE-1333, CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P