Executive brief
Open Mercato is an AI-driven framework used for building CRM and ERP business systems. A security flaw allows administrative users to input malicious validation rules (regular expressions) that can crash the system or cause severe performance slowdowns. This could lead to a service outage, preventing employees from accessing business-critical data and workflows.
Technical details
A Regular Expression Denial of Service (ReDoS) vulnerability exists in Open Mercato due to a lack of validation for custom regex rules. The flaw is rooted in CWE-1333 (Inefficient Regular Expression Complexity), where the application fails to sanitize or bound regex patterns used in custom fields, business rules, and workflow triggers. An attacker with high privileges (PR:H) can submit a "catastrophic backtracking" regex pattern. When the system subsequently attempts to match a specific string against this pattern, it triggers extreme CPU consumption, leading to a Denial of Service (DoS). The fix, introduced in version 0.6.4, involves migrating to RE2JS for linear-time regex matching and implementing fail-closed validation caps.
Affected products
- Open Mercato Open Mercato < 0.6.4
Timeline
- 2026-05-21: patched: Fix merged in GitHub pull request #1996
- 2026-07-22: disclosed: Vulnerability disclosed by CERT Polska
- 2026-07-22: advisory: CVE-2026-16270 published