Executive brief
ansi2html is a JavaScript library used to convert ANSI escape codes (terminal color and formatting sequences) into HTML. A maliciously crafted input string can cause the library's regex parsing to consume excessive CPU time, potentially freezing or crashing applications that process untrusted text. This is particularly risky for web services or tools that accept user-generated content.
Technical details
The vulnerability is a ReDoS (Regular Expression Denial of Service) issue in ansi2html's regex pattern matching for parsing ANSI escape sequences. When specially crafted input strings with repeated digits followed by ANSI-like sequences (e.g., "[1111111111111111111111;0000000000000000000000") are processed, the regex engine experiences catastrophic backtracking. An attacker can provide such input to any application using ansi2html to parse user-supplied content, causing severe CPU consumption and application hang or crash. The library remained vulnerable with no updates; mitigation requires either avoiding user input, implementing strict size limits, or switching to a maintained alternative.
Affected products
- ansi2html ansi2html all versions
Timeline
- 2020-09-01: disclosed