CVE-2024-21539: Regular Expression Denial of Service (ReDoS) in @eslint/plugin-kit

November 15, 2024 (updated November 19, 2024)

Crafting a very large and well crafted string can increase the CPU usage and crash the program.

References

github.com/advisories/GHSA-7q7g-4xm8-89cq
github.com/eslint/rewrite
github.com/eslint/rewrite/commit/071be842f0bd58de4863cdf2ab86d60f49912abf
github.com/eslint/rewrite/security/advisories/GHSA-7q7g-4xm8-89cq
nvd.nist.gov/vuln/detail/CVE-2024-21539
security.snyk.io/vuln/SNYK-JS-ESLINTPLUGINKIT-8340627

Code Behaviors & Features

Detect and mitigate CVE-2024-21539 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →