PT-2019-20068 · Epeli · Underscore.String

Published 2019-06-14 · Updated 2019-06-14

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions underscore.string versions prior to 3.3.5

Description The issue concerns a Regular Expression Denial of Service (ReDoS) in the unescapeHTML function due to an overly-broad regex. This results in a slowdown that grows exponentially with larger inputs, approximately 2s for 50,000 characters.

Recommendations Upgrade to version 3.3.5 or higher.

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

GHSA-V2P6-4MP7-3R9V

Affected Products

Underscore.String

References · 5

• https://osv.dev/vulnerability/GHSA-v2p6-4mp7-3r9v · Vendor Advisory
• https://github.com/epeli/underscore.string/pull/517 · Note
• https://github.com/epeli/underscore.string/issues/510 · Note
• https://github.com/epeli/underscore.string/commit/f486cd684c94c12db48b45d52b1472a1b9661029 · Note
• https://npmjs.com/advisories/745 · Note