Executive brief
ansi-html is a JavaScript library that converts ANSI escape codes to HTML. An attacker can provide a specially crafted string that causes the library to enter an infinite or extremely long processing loop, resulting in denial of service and application hang. This can disrupt any service or application that uses this library to process untrusted input.
Technical details
This is an uncontrolled resource consumption vulnerability (CWE-400) affecting all versions of ansi-html prior to 0.0.8. The vulnerability is triggered when a malicious string is passed to the library for ANSI-to-HTML conversion; the vulnerable parsing logic becomes stuck in a lengthy processing loop, consuming excessive CPU resources. The attack vector is network-based with no authentication or user interaction required if the application exposes the library to untrusted input. An attacker can trigger denial of service against the application. The fix is available in version 0.0.8 and later (commit 8142b25bca3133ea060bcc1889277dc482327a63).
Affected products
- Tjatse ansi-html before 0.0.8
Timeline
- 2021-08-18: disclosed: NVD publication date
- 2021-09-02: advisory: GHSA published
- 2021: patched: Fix released in version 0.0.8