Executive brief
Papa Parse is a widely-used JavaScript library for parsing CSV data. A malformed regular expression in its number-parsing logic can be exploited to cause a denial of service by forcing the parser to consume excessive CPU time when processing certain inputs. An attacker can craft specific CSV data that triggers exponential regex matching time, causing the application to hang or freeze.
Technical details
This is a regular expression denial of service (ReDoS) vulnerability in Papa Parse's parse() function, specifically in the FLOAT regex pattern used to detect numeric values. The vulnerable regex contains nested quantifiers in the pattern (\d*\.?\d+|\d+\.?\d*) that cause catastrophic backtracking when processing non-numeric input. The attack is network-reachable and requires no authentication or user interaction—an attacker can submit malicious CSV data to an application using Papa Parse with dynamicTyping enabled. Processing specially crafted input (e.g., a long string of digits followed by a letter) causes processing time to grow exponentially, stalling the system and leading to denial of service. The vulnerability affects all versions prior to 5.2.0, which replaced the malformed regex with a corrected pattern.
Affected products
- Papa Parse Papa Parse < 5.2.0
Timeline
- 2020-04-02: disclosed: Vulnerability reported in GitHub issue #777
- 2020-09-04: patched: Fixed in version 5.2.0
- 2020-09-04: advisory: GHSA-qvjc-g5vr-mfgr published