Log in Start free

Vulnerability · Published Jun 9, 2025 · Assigned by VulDB

CVE-2025-5897vuejs vue-cli Markdown Code HtmlPwaPlugin.js HtmlPwaPlugin redos

Medium 4.3

In plain English

A medium-severity regular-expression denial of service in vue-cli from vuejs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.7%top 48.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in vuejs vue-cli up to 5.0.8. It has been rated as problematic. This issue affects the function HtmlPwaPlugin of the file packages/@vue/cli-plugin-pwa/lib/HtmlPwaPlugin.js of the component Markdown Code Handler. The manipulation leads to inefficient regular expression complexity. The attack may be initiated remotely.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npm@vue/cli-plugin-pwano fix listedGHSA-79vf-hf9f-j9q8

Affected products (as reported)

VendorProductVersions
vuejs vue-cli 5.0.05.0.15.0.25.0.35.0.45.0.55.0.65.0.7

Weakness: CWE-1333, CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:T/RC:R

References