GHSA-p8pc-3f7w-jr5q

Foundation Regular Expression Denial of Service vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-26304

Packages

Ecosystem	Package	Affected	Fixed in
npm	foundation-sites	<= 6.3.3	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Foundation is a front-end framework. Versions 6.3.3 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, it is unknown if any fixes are available.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-26304 advisory
https://github.com/foundation/foundation-sites/issues/12180 web
https://github.com/foundation/foundation-sites package
https://securitylab.github.com/advisories/GHSL-2020-290-redos-foundation-sites advisory