PT-2020-21092 · Acorn · Acorn

Published 2020-04-03 · Updated 2020-04-03

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions acorn (affected versions not specified)

Description The issue concerns a Regular Expression Denial of Service. A regex in the form of /[x-ud800]/u can cause the parser to enter an infinite loop. This occurs because the string is not valid UTF16, which is usually sanitized before reaching the parser. If an application processes untrusted input and passes it directly, attackers may leverage this issue, leading to Denial of Service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

GHSA-6CHW-6FRG-F759

Affected Products

Acorn

References · 5

• https://osv.dev/vulnerability/GHSA-6chw-6frg-f759 · Vendor Advisory
• https://github.com/acornjs/acorn/issues/929 · Note
• https://github.com/acornjs/acorn/commit/793c0e569ed1158672e3a40aeed1d8518832b802 · Note
• https://snyk.io/vuln/SNYK-JS-ACORN-559469 · Note
• https://npmjs.com/advisories/1488 · Note