Executive brief
Knwl.js is a JavaScript library that extracts structured data like dates, emails, and phone numbers from text. Attackers can craft malicious text input that triggers excessive CPU usage during pattern matching, causing the application to become unresponsive or hang—a denial-of-service condition that could disrupt services relying on this library for data extraction.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) weakness caused by one or more poorly constructed regular expressions in the Knwl.js pattern-matching logic. An attacker can supply specially crafted text input that triggers catastrophic backtracking in the regex engine, consuming excessive CPU resources. The attack requires only network access to a service using the library and no authentication; vulnerable versions are 1.0.2 and earlier. As of the advisory publication, no patch has been released; users should monitor for updates or consider switching to an alternative library.
Affected products
- Knwl knwl.js 1.0.2 and prior
Timeline
- 2024-10-26: disclosed: Advisory published as GHSA-68qg-g787-3rp5
- 2020-11-30: other: GitHub Security Lab initially reported issue #106 requesting security advisory