CVE-2021-43838: Uncontrolled Resource Consumption

December 17, 2021 (updated July 21, 2023)

jsx-slack is a library for building JSON objects for Slack Block Kit surfaces from JSX. users is vulnerable to a regular expression denial-of-service (ReDoS) attack. If attacker can put a lot of JSX elements into <blockquote> tag, an internal regular expression for escaping characters may consume an excessive amount of computing resources. jsx-slack v4.5.1 has patched to a regex for escaping blockquote characters.

References

github.com/yhatt/jsx-slack/commit/36e4a10405e4c7745333e245fcc5029c02c7065d
github.com/yhatt/jsx-slack/security/advisories/GHSA-55xv-f85c-248q
nvd.nist.gov/vuln/detail/CVE-2021-43838

Code Behaviors & Features

Detect and mitigate CVE-2021-43838 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →