jsx-slack insufficient patch for CVE-2021-43838 ReDoS

Description

We found the patch for CVE-2021-43838 in jsx-slack v4.5.1 is insufficient to save from Regular Expression Denial of Service (ReDoS) attack.

This vulnerability affects to jsx-slack v4.5.1 and earlier versions.

Recommendation

Update the jsx-slack package to the latest compatible version. Followings are version details:

• Affected version(s): < 4.5.2
• Patched version(s): 4.5.2

References

• GHSA-hp68-xhvj-x6j6
• CVE-2021-43843
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Prototype Pollution in lodash (GHSA-jf85-cpcp-j695) 4 - CVE-2019-10744
• Prototype Pollution in lodash (GHSA-jf85-cpcp-j695) 2 - CVE-2019-10744
• Passbolt Browser Extension leaks password information - CVE-2024-33669
• JSONata expression can pollute the "Object" prototype - CVE-2024-27307

Tags:

npm

jsx-slack