Executive brief
The trim library is a JavaScript utility package that removes whitespace from strings. A flaw in its regular expression pattern can be exploited to cause a denial of service, making applications using this package unresponsive under carefully crafted input.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) vulnerability in the trim() function caused by a poorly designed regex pattern. The flaw exists in all versions before 0.0.3 and can be triggered by providing specially crafted input containing repeated whitespace or similar patterns that cause catastrophic backtracking in the regex engine. The attack requires only network access to an application using the affected library and no authentication; the input can be supplied directly to the trim() function. An attacker can cause CPU exhaustion and service unavailability. The vulnerability was fixed in version 0.0.3, which replaced the vulnerable regex with an optimized pattern.
Affected products
- component trim < 0.0.3
Timeline
- 2020-10-27: disclosed: CVE-2020-7753 published on NVD
- 2020-10-30: patched: Fix merged in GitHub PR #8
- 2021-05-10: advisory: GHSA-w5p7-h5w8-2hfq published