GHSA-5cmr-4px5-23pc

XGrammar affected by Denial of Service by infinite recursion grammars

Source: GitHub Advisory Database (reviewed) High CVE-2025-57809

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	xgrammar	< 0.1.21	0.1.21

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary This issue: http://github.com/mlc-ai/xgrammar/issues/250 should have it's own security advisory. Since several tools accept and pass user supplied grammars to xgrammar, and it is so easy to trigger it seems like a High.

References

External links from the advisory. They lead to third-party sites.

https://github.com/mlc-ai/xgrammar/security/advisories/GHSA-5cmr-4px5-23pc web
https://nvd.nist.gov/vuln/detail/CVE-2025-57809 advisory
https://github.com/mlc-ai/xgrammar/issues/250 web
https://github.com/mlc-ai/xgrammar/commit/b943feacb5a1caf4d39de8ec3bf7c7ce066dcee5 web
https://github.com/mlc-ai/xgrammar package