Executive brief
glob-parent is a widely-used JavaScript utility library for extracting the parent directory from glob patterns. A flaw in its regular expression for validating path enclosures allows attackers to cause excessive CPU consumption through specially crafted input, potentially disrupting services that depend on this library and slowing down build or file-processing pipelines.
Technical details
This vulnerability is a Regular Expression Denial of Service (ReDoS) vulnerability affecting the enclosure regex pattern in glob-parent versions before 5.1.2. The vulnerable regex used to validate strings ending in enclosure containing path separators contains catastrophic backtracking when presented with specially crafted input. The flaw is in the library's core pattern-matching logic, reachable via any code path that invokes glob-parent without requiring authentication. An attacker can provide malicious glob patterns that cause the regex engine to consume excessive CPU cycles, leading to denial of service. The vulnerability has been patched in version 5.1.2; affected versions are 4.0.0 through 5.1.1.
Affected products
- Gulp glob-parent 4.0.0 to 5.1.1
Timeline
- 2021-06-03: disclosed: CVE published
- 2021-06-04: patched: Fix merged into main branch
- 2021-06-07: advisory: GHSA-ww39-953v-wcq6 published