Skip to content

Regular Expression Denial of Service (ReDoS) Vulnerability

Moderate
Marsup published GHSA-c2jc-4fpr-4vhg Feb 8, 2023

Package

npm @sideway/formula (npm)

Affected versions

< 3.0.1

Patched versions

3.0.1

Description

Impact

User-provided strings to formula's parser might lead to polynomial execution time.

Patches

Users should upgrade to 3.0.1+.

Workarounds

None.

Severity

Moderate
5.5
/ 10

CVSS base metrics

Attack vector
Local
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVE ID

CVE-2023-25166

Weaknesses

Credits