Executive brief
jsx-slack is a library for rendering JSX to Slack message blocks. An attacker can craft a blockquote element containing many JSX elements with multibyte characters to trigger excessive CPU consumption in the library's character-escaping regular expression. This causes a denial-of-service condition that impacts availability of applications using the library.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) in jsx-slack's blockquote character-escaping logic. The root cause is an inefficient regular expression with catastrophic backtracking behavior when processing multibyte characters. An attacker can supply input with multiple JSX elements containing multibyte characters (e.g., CJK characters) nested within blockquote tags. This causes the regex engine to experience exponential backtracking, consuming excessive CPU cycles and denying service. The previous patch (v4.5.1) addressed only ASCII characters but left the multibyte case vulnerable. Version 4.5.2 updates the regular expressions to prevent catastrophic backtracking and includes test coverage for multibyte scenarios.
Affected products
- jsx-slack jsx-slack <4.5.2
Timeline
- 2021-12-18: disclosed
- 2022-01-06: patched: v4.5.2 released