[GHSA-v6h2-p8h4-qcjw] brace-expansion Regular Expression Denial of Service vulnerability #5712
Conversation
github-actions
bot
changed the base branch from
main
to
davidhornmarkINGKA/advisory-improvement-5712
There was a problem hiding this comment.
Pull Request Overview
This PR updates the GitHub advisory for the brace-expansion Regular Expression Denial of Service issue by adjusting timestamps, severity scoring, and splitting affected version ranges per major release.
- Updated the
modifiedtimestamp. - Replaced CVSS v3 entry with a CVSS v4 score.
- Expanded
rangesinto separate blocks for each major version and addeddatabase_specificmetadata.
Comments suppressed due to low confidence (1)
advisories/github-reviewed/2025/06/GHSA-v6h2-p8h4-qcjw/GHSA-v6h2-p8h4-qcjw.json:13
- The original CVSS v3 entry was removed; to preserve full severity context you should retain both CVSS v3 and CVSS v4 objects in the
severityarray.
"type": "CVSS_V4",
| "type": "ECOSYSTEM", | ||
| "events": [ | ||
| { | ||
| "introduced": "0" |
There was a problem hiding this comment.
This range block is intended for versions <2.0.2; use "introduced": "2.0.0" instead of "0" to avoid overlap with the 0–1.x block.
| "introduced": "0" | |
| "introduced": "2.0.0" |
Copilot uses AI. Check for mistakes.
| "type": "ECOSYSTEM", | ||
| "events": [ | ||
| { | ||
| "introduced": "0" |
There was a problem hiding this comment.
For the 3.x range, set "introduced": "3.0.0" rather than "0" to clearly delimit the affected versions.
| "introduced": "0" | |
| "introduced": "3.0.0" |
Copilot uses AI. Check for mistakes.
| "type": "ECOSYSTEM", | ||
| "events": [ | ||
| { | ||
| "introduced": "0" |
There was a problem hiding this comment.
For the 4.x range, use "introduced": "4.0.0" instead of "0" to avoid unintentional overlap with earlier ranges.
| "introduced": "0" | |
| "introduced": "4.0.0" |
Copilot uses AI. Check for mistakes.
|
Not sure why it instantly gives error to the vector string when trying to improve advisory: |
Updates
Comments
https://github.com/juliangruber/brace-expansion/releases has released patched versions and published them to npm.