GHSA-v63q-hgqc-qvpg

MooTools Regular Expression Denial of Service

Source: GitHub Advisory Database (reviewed) High CVE-2021-32821

Packages

Ecosystem	Package	Affected	Fixed in
npm	mootools	<= 1.5.2	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

MooTools is a collection of JavaScript utilities for JavaScript developers. All known versions include a CSS selector parser that is vulnerable to Regular Expression Denial of Service (ReDoS). An attack requires that an attacker can inject a string into a CSS selector at runtime, which is quite common with e.g. jQuery CSS selectors. No patches are available for this issue.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-32821 advisory
https://github.com/vsviridov/mootools-node package
https://securitylab.github.com/advisories/GHSL-2020-345-redos-mootools advisory