Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXYycDYtNG1wNy0zcjl2

Regular Expression Denial of Service in underscore.string

Versions of underscore.string prior to 3.3.5 are vulnerable to Regular Expression Denial of Service (ReDoS).

The function unescapeHTML is vulnerable to ReDoS due to an overly-broad regex. The slowdown is approximately 2s for 50,000 characters but grows exponentially with larger inputs.

Recommendation

Upgrade to version 3.3.5 or higher.

Permalink: https://github.com/advisories/GHSA-v2p6-4mp7-3r9v
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXYycDYtNG1wNy0zcjl2
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 5 years ago
Updated: over 1 year ago


Identifiers: GHSA-v2p6-4mp7-3r9v
References: Repository: https://github.com/epeli/underscore.string
Blast Radius: 0.0

Affected Packages

npm:underscore.string
Dependent packages: 3,332
Dependent repositories: 255,082
Downloads: 8,354,047 last month
Affected Version Ranges: < 3.3.5
Fixed in: 3.3.5
All affected versions: 0.9.2, 1.0.0, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 2.0.0, 2.1.0, 2.1.1, 2.2.1, 2.3.0, 2.3.1, 2.3.2, 2.3.3, 2.4.0, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.1.0, 3.1.1, 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.3.0, 3.3.2, 3.3.3, 3.3.4
All unaffected versions: 3.3.5, 3.3.6