~ / search / GHSA-hhfg-6hfc-rvxm

GHSA-hhfg-6hfc-rvxm

Regular Expression Denial of Service in jsoneditor

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-3822

Packages

EcosystemPackageAffectedFixed in
npm jsoneditor < 9.5.6 9.5.6

Details

As written in the advisory (Markdown source, shown as plain text).

JSON Editor is a web-based tool to view, edit, format, and validate JSON. It has various modes such as a tree editor, a code editor, and a plain text editor. The jsoneditor package is vulnerable to ReDoS (regular expression denial of service). An attacker that is able to provide a crafted element as input to the getInnerText function may cause an application to consume an excessive amount of CPU. Below pinned line using vulnerable regex.

References

External links from the advisory. They lead to third-party sites.