Regular Expression Denial of Service in remarkable · CVE-2019-12041 · GitHub Advisory Database · GitHub

Regular Expression Denial of Service in remarkable

High severity GitHub Reviewed Published Jun 6, 2019 to the GitHub Advisory Database • Updated Apr 22, 2024

Package

remarkable (npm)

Affected versions

< 1.7.2

Patched versions

1.7.2

Description

lib/common/html_re.js in remarkable 1.7.1 allows Regular Expression Denial of Service (ReDoS) via a CDATA section.

References

Published by the National Vulnerability Database

May 13, 2019

Reviewed Jun 6, 2019

Published to the GitHub Advisory Database Jun 6, 2019

Last updated Apr 22, 2024

Severity

High

7.5

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H