Executive brief
is-svg is a popular JavaScript library used to detect whether a string or buffer contains valid SVG content. A Regular Expression Denial of Service (ReDOS) vulnerability allows an attacker to provide a malformed SVG string that causes the library to hang or consume excessive CPU resources, potentially disrupting applications that depend on this validation.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDOS) in is-svg versions 4.3.1 and below, introduced in version 2.1.0. The flaw exists in the regular expression used to validate SVG strings; when the library processes a specially crafted invalid SVG string, the regex engine enters catastrophic backtracking, causing the validation to hang indefinitely or consume excessive CPU. The attack requires network reachability to the application using is-svg and no authentication; the attacker simply provides a malformed SVG string for validation. A successful exploit results in denial of service. The vulnerability was fixed in version 4.3.0, as evidenced by a commit that replaced the vulnerable regex-based approach with a fast-xml-parser dependency.
Affected products
- npm is-svg 2.1.0 through 4.3.1
Timeline
- 2021-06-21: disclosed
- 2021-03-16: patched: Fix committed; version 4.3.0 released
- 2021-12-10: advisory: GHSA published