Executive brief
ESLint is a popular JavaScript code analysis tool used by developers to enforce code quality standards. A vulnerability in the template placeholder replacement logic allows an attacker to cause excessive CPU consumption through a specially crafted input, potentially disrupting development workflows or continuous integration systems.
Technical details
The vulnerability is a regular expression denial of service (ReDoS) caused by catastrophic backtracking in the interpolate.js module. The regex pattern used for template variable substitution (`{{\s*([^{}]+?)\s*}}`) is vulnerable to O(n²) backtracking when processing malformed input containing unmatched braces and whitespace. The flaw is located in error message template handling and could be triggered if an attacker can control input fed to ESLint's message interpolation. The fix modifies the regex to exclude fields with whitespace, eliminating the backtracking vulnerability. Patch is available in version 4.18.2 and later.
Affected products
- OpenJS Foundation ESLint before 4.18.2
Timeline
- 2018-02-22: disclosed
- 2018: patched: Fix committed addressing the catastrophic backtracking vulnerability
- 2021-02-25: advisory