GHSA-68qg-g787-3rp5

Knwl.js Regular Expression Denial of Service vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-26306

Packages

Ecosystem	Package	Affected	Fixed in
npm	knwl.js	<= 1.0.2	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Knwl.js is a Javascript library that parses through text for dates, times, phone numbers, emails, places, and more. Versions 1.0.2 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches are available.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-26306 advisory
https://github.com/benhmoore/Knwl/issues/106 web
https://github.com/benhmoore/Knwl/commit/88aa966b1415a167c7c91b70053b72c7762c1cc0 web
https://github.com/benhmoore/Knwl package
https://securitylab.github.com/advisories/GHSL-2020-296-redos-Knwl.js advisory