Executive brief
riot-compiler is a JavaScript library used to compile Riot.js web components. A flaw in the library's regular expression parsing can cause it to hang or crash when processing specially crafted input, disrupting development workflows and potentially impacting deployed applications that rely on dynamic compilation.
Technical details
The vulnerability is a regular expression denial of service (ReDoS) caused by catastrophic backtracking in riot-compiler's regex patterns. An attacker can provide input containing specific character sequences that cause exponential time complexity in regex matching, effectively freezing the compiler. The vulnerability affects all versions prior to 2.3.22, with the flaw stemming from an improperly constructed regular expression used during component parsing. No authentication is required; the attack is triggered by supplying malicious input to the compilation process.
Affected products
- riot riot-compiler before 2.3.22
Timeline
- 2016-01-16: disclosed: Issue #46 opened describing catastrophic backtracking in regex
- 2019-02-18: advisory: GHSA-pp4v-55vr-9gxh published
- 2.3.22: patched: Fixed version released