Executive brief
MooTools is a JavaScript library used for client-side and server-side web development. The library contains a CSS selector parser vulnerable to regular expression denial of service (ReDoS), which allows an attacker to inject a malicious CSS selector string to consume excessive CPU resources and cause service unavailability. This is a persistent vulnerability affecting all known versions with no patches available.
Technical details
MooTools contains a regular expression denial of service (ReDoS) vulnerability in its CSS selector parser (CWE-1333, CWE-400). The vulnerability exists in the CSS selector parsing logic which uses a regex pattern susceptible to catastrophic backtracking. An attacker can exploit this by injecting a specially crafted CSS selector string at runtime—a scenario common in applications using dynamic CSS selector construction or jQuery-like APIs. When the vulnerable regex processes the malicious input, it causes exponential backtracking, consuming CPU resources and leading to denial of service. All versions up to and including 1.5.2 are affected, and no patches have been released as of the advisory publication date.
Affected products
- MooTools MooTools 1.5.2 and earlier
Timeline
- 2023-01-03: disclosed
- 2023-01-03: other: Advisory published