~ / search / GHSA-qvjc-g5vr-mfgr

GHSA-qvjc-g5vr-mfgr

Regular Expression Denial of Service in papaparse

Source: GitHub Advisory Database (reviewed) High CVE-2020-36649

Packages

EcosystemPackageAffectedFixed in
npm papaparse < 5.2.0 5.2.0

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of `papaparse` prior to 5.2.0 are vulnerable to Regular Expression Denial of Service (ReDos). The `parse` function contains a malformed regular expression that takes exponentially longer to process non-numerical inputs. This allows attackers to stall systems and lead to Denial of Service. ## Recommendation Upgrade to version 5.2.0 or later.

References

External links from the advisory. They lead to third-party sites.