Executive brief
markdown-link-extractor is a npm library that parses markdown text to extract URLs. A flaw in its regular expression parsing logic allows an attacker to supply specially crafted markdown input that causes the regular expression engine to hang or consume excessive CPU, disrupting services that depend on this library.
Technical details
This is a Regular Expression Denial of Service (ReDoS) vulnerability in the markdown-link-extractor npm package, classified as CWE-1333. The vulnerability exists in the regular expression used by the module's exported function to parse markdown links. An attacker who can supply arbitrary markdown input to the function can trigger exponential backtracking in the regex engine, causing the application to hang or consume significant CPU resources. The vulnerability affects all versions before 3.0.2 and version 4.0.0 before 4.0.1. Patches are available in versions 3.0.2 and 4.0.1.
Affected products
- markdown-link-extractor markdown-link-extractor before 3.0.2; 4.0.0 before 4.0.1
Timeline
- 2022-06-02: disclosed: Published on NVD
- 2022-06-03: advisory: GitHub Security Advisory GHSA-mmh6-m7v9-5956 published
- 2022: patched: Fixed in versions 3.0.2 and 4.0.1