Executive brief
@eslint/plugin-kit is a library used by ESLint plugins to parse configuration comments. A flaw in its regular expression parser can be triggered by specially crafted input to consume excessive CPU and block execution, potentially causing denial of service in any tool or development environment that uses this library to process untrusted ESLint configuration comments.
Technical details
The ConfigCommentParser#parseJSONLikeConfig API contains a Regular Expression Denial of Service (ReDoS) vulnerability in its regex pattern at config-comment-parser.js:158. The vulnerable regex has an unanchored grouped expression that exhibits quadratic runtime behavior when processing certain input patterns. An attacker can craft a string with many repeated characters (e.g., 1 million 'A' characters) followed by specific syntax to trigger catastrophic backtracking, causing the regex engine to hang with high CPU usage. The fix, released in version 0.3.4, anchors the expression with [^-a-zA-Z0-9/] to prevent the backtracking condition.
Affected products
- ESLint plugin-kit before 0.3.4
Timeline
- 2025-07-18: disclosed
- 2025-07-18: patched: Version 0.3.4 released with fix