GHSA-mmh6-m7v9-5956

Source

https://github.com/advisories/GHSA-mmh6-m7v9-5956

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-mmh6-m7v9-5956/GHSA-mmh6-m7v9-5956.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-mmh6-m7v9-5956

Aliases

CVE-2021-43308

Published

2022-06-03T00:01:00Z

Modified

2023-11-08T04:07:09Z

Summary

Regular expression denial of service in markdown-link-extractor

Details

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbitrary input to the module's exported function

Database specific

{
    "cwe_ids":  [
        "CWE-1333"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2022-06-03T22:25:16Z",
    "nvd_published_at":  "2022-06-02T14:15:00Z",
    "severity":  "LOW"
}

References

Affected packages

npm / markdown-link-extractor

Package

Name: markdown-link-extractor; View open source insights on deps.dev
Purl: pkg:npm/markdown-link-extractor

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.0.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-mmh6-m7v9-5956/GHSA-mmh6-m7v9-5956.json"

npm / markdown-link-extractor

Package

Name: markdown-link-extractor; View open source insights on deps.dev
Purl: pkg:npm/markdown-link-extractor

Affected ranges

Type: SEMVER
Events: Introduced

4.0.0

Fixed

4.0.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-mmh6-m7v9-5956/GHSA-mmh6-m7v9-5956.json"