CVE-2017-18077

HIGH7.5EPSS 0.52%

ReDoS in brace-expansion

Published: 1/29/2018Modified: 11/8/2023
Also known as:GHSA-832h-xg76-4gv6DEBIAN-CVE-2017-18077

Description

Affected versions of `brace-expansion` are vulnerable to a regular expression denial of service condition. ## Proof of Concept ``` var expand = require('brace-expansion'); expand('{,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,\n}'); ``` ## Recommendation Update to version 1.1.7 or later.

Affected packages (2)

CVSS scores

SourceVersionSeverityVector
osvCVSS 3.1HIGH7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References (9)