Executive brief
mel-spintax is a JavaScript library for template text expansion. The library contains an inefficient regular expression that can be exploited through crafted input to cause excessive CPU consumption, potentially causing application denial of service.
Technical details
The vulnerability is a regular expression denial of service (ReDoS) issue in lib/spintax.js triggered by inefficient regex pattern complexity. An authenticated or local attacker can supply specially crafted text input to the library's text processing function to cause catastrophic backtracking in the regex engine, resulting in high CPU usage and application slowdown. The vulnerability affects all versions prior to 1.0.3, which includes a fix to the regular expression pattern. The attack requires no special privileges and the malicious input can be provided directly through the library API.
Affected products
- melnaron mel-spintax before 1.0.3
Timeline
- 2023-01-18: disclosed: GHSA-qjm7-55vv-3c5f published
- 2023-01-20: patched: GitHub advisory reviewed; patch available in version 1.0.3