Zoo Design Studio KCL parser stack overflow via recursive expression parsing

Executive brief

Zoo Design Studio's KCL language parser contains a vulnerability that allows remote attackers to crash the application by submitting specially crafted code with deeply nested parentheses. An attacker can trigger a denial-of-service by providing malicious KCL programs that cause the parser to recursively process expressions until the system runs out of memory on the call stack. This impacts availability of services or applications that use Zoo Design Studio for parsing or processing user-supplied KCL code.

Technical details

The vulnerability is a stack overflow in the KCL parser's recursive grammar rules. The parser enters an infinite-like recursion cycle through the path expression → unnecessarily_bracketed → expression when processing deeply nested parenthesized expressions. With sufficient nesting depth, the call stack exceeds system limits and causes a crash. The attack is a classic denial-of-service vector requiring no authentication or user interaction, only the ability to supply a malicious KCL program to a system running the vulnerable library. Both the Rust crate kcl-lib (versions < 0.2.129) and Python package zoo-kcl (versions < 0.3.129) are affected. Patches are available in kcl-lib 0.3.129 and zoo-kcl 0.3.129.

Affected products

• KittyCAD kcl-lib < 0.2.129
• KittyCAD zoo-kcl < 0.3.129

Timeline

• 2026-06-12: disclosed: Vulnerability published by maxammann to KittyCAD/modeling-app repository
• 2026-08-20: advisory: Published to GitHub Advisory Database
• 2026-08-20: patched: Patches released: kcl-lib 0.3.129, zoo-kcl 0.3.129

References

• https://api.github.com/users/maxammann
• https://github.com/maxammann
• https://api.github.com/users/maxammann/gists%7B/gist_id%7D
• https://api.github.com/users/maxammann/repos
• https://avatars.githubusercontent.com/u/905221?v=4
• https://api.github.com/users/maxammann/events%7B/privacy%7D