GMS-2020-1: Regular Expression Denial of Service

March 2, 2020 (updated March 6, 2020)

A regex in the form of /[x-\ud800]/u causes the parser to enter an infinite loop. The string is not valid UTF16 which usually results in it being sanitized before reaching the parser.

References

github.com/acornjs/acorn/commit/793c0e569ed1158672e3a40aeed1d8518832b802
snyk.io/vuln/SNYK-JS-ACORN-559469
www.npmjs.com/advisories/1488

Code Behaviors & Features

Detect and mitigate GMS-2020-1 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →