Executive brief
@eslint/plugin-kit is a library used by ESLint plugins for parsing configuration comments in code. An attacker can craft a specially formed string to trigger excessive CPU usage, causing the parser to hang or crash and disrupting development tools and CI/CD pipelines that rely on ESLint.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) in the ConfigCommentParser component of @eslint/plugin-kit. The parseStringConfig() method contains a poorly constructed regex pattern that exhibits catastrophic backtracking when processing large strings with specific character patterns (e.g., many spaces followed by a non-matching character). An authenticated user or local developer can trigger this by supplying a malicious configuration comment string to the parser, causing it to consume excessive CPU and potentially hang indefinitely. The vulnerability was patched in version 0.2.3.
Affected products
- ESLint @eslint/plugin-kit All versions before 0.2.3
Timeline
- 2024-11-15: disclosed
- 2024-11-15: patched: Version 0.2.3 released with fix
- 2024-11-19: advisory: NVD published CVE-2024-21539