Mmmsssttt

Name of the Vulnerable Software and Affected Versions: yarnpkg Yarn versions up to 1.22.22 Description: A vulnerability exists in Yarn Package Manager due to inefficient regular expression complexity within the `setOptions` function located in the `src/util/request-manager.js` file. Local access is required for exploitation. This issue affects products that are no longer supported by the maintainer. Recommendations: Versions prior to 1.22.22 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** yarnpkg Yarn versions up to 1.22.22 **Description** A vulnerability exists in the `explodeHostedGitFragment` function within the `src/resolvers/exotics/hosted-git-resolver.js` file. This manipulation results in inefficient regular expression complexity, potentially allowing for remote exploitation. **Recommendations** Apply the patch identified as 97731871e674bf93bcbf29e9d3258da8685f3076 to resolve this issue.

Name of the Vulnerable Software and Affected Versions: MarkText versions up to 0.17.1 Description: A vulnerability has been found in MarkText, affecting the function `getRecommendTitleFromMarkdownString` of the file marktext/src/main/utils/index.js. The manipulation leads to inefficient regular expression complexity. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Recommendations: For MarkText versions up to 0.17.1, consider disabling the `getRecommendTitleFromMarkdownString` function until a patch is available to prevent potential remote attacks. Restrict access to the marktext/src/main/utils/index.js file to minimize the risk of exploitation. Avoid using the `getRecommendTitleFromMarkdownString` function in remote operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** RocketChat versions up to 7.6.1 **Description** A problematic issue has been found in RocketChat, affecting the `parseMessage` function of the file `/apps/meteor/app/irc/server/servers/RFC2813/parseMessage.js`. The manipulation of the `line` argument leads to inefficient regular expression complexity. This issue can be exploited remotely. **Recommendations** For RocketChat versions up to 7.6.1, consider updating to a version that includes a fix for this issue, as the current version is affected by the inefficient regular expression complexity in the `parseMessage` function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Metabase version 54.10 **Description** A problematic issue was found in the function `parseDataUri` of the file `frontend/src/metabase/lib/dom.js`. This issue leads to inefficient regular expression complexity and can be initiated remotely. **Recommendations** To fix this issue, apply the patch 4454ebbdc7719016bf80ca0f34859ce5cee9f6b0. As a temporary workaround, consider restricting access to the `parseDataUri` function until the patch is applied.

**Name of the Vulnerable Software and Affected Versions** juliangruber brace-expansion versions 1.1.11 through 4.0.0 **Description** A vulnerability was found in the function `expand` of the file index.js, leading to inefficient regular expression complexity. The attack may be launched remotely, with a rather high complexity. The exploitation is known to be difficult, and the exploit has been disclosed to the public. **Recommendations** To address this issue, upgrade to version 1.1.12, 2.0.2, 3.0.1, or 4.0.1. As a temporary workaround, consider disabling the `expand` function until a patch is available. Restrict access to the vulnerable `index.js` file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** vuejs vue-cli versions up to 5.0.8 **Description** A vulnerability was found in the function `HtmlPwaPlugin` of the file `packages/@vue/cli-plugin-pwa/lib/HtmlPwaPlugin.js` of the component Markdown Code Handler. The manipulation leads to inefficient regular expression complexity. The attack may be initiated remotely. **Recommendations** For versions up to 5.0.8, consider updating to a version that contains a fix for this issue, as the current version is affected by inefficient regular expression complexity in the `HtmlPwaPlugin` function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** tarojs taro versions 4.1.1 and earlier **Description** A vulnerability was found in the tarojs taro software, which has been declared as problematic. This issue affects unknown code of the file taro/packages/css-to-react-native/src/index.js, leading to inefficient regular expression complexity. The attack can be initiated remotely. **Recommendations** For versions 4.1.1 and earlier, upgrade to version 4.1.2 to address this issue.

**Name of the Vulnerable Software and Affected Versions** actions toolkit version 0.5.0 **Description** A problematic vulnerability has been found in the actions toolkit. This issue affects the `globEscape` function of the `glob` component, specifically in the file `toolkit/packages/glob/src/internal-pattern.ts`. The manipulation leads to inefficient regular expression complexity, and it is possible to initiate the attack remotely. **Recommendations** For actions toolkit version 0.5.0, consider restricting the use of the `globEscape` function until a patch is available. As a temporary workaround, avoid using the `glob` component in situations where remote attacks are a concern.

**Name of the Vulnerable Software and Affected Versions** Unitech pm2 versions up to 6.0.6 **Description** A problematic vulnerability was found in Unitech pm2, affecting unknown code of the file /lib/tools/Config.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely. **Recommendations** For Unitech pm2 versions up to 6.0.6, update to a version later than 6.0.6 to resolve the issue. At the moment, there is no information about additional mitigation measures for this vulnerability.