Regular Expression Denial of Service in remarkable

Description

lib/common/html_re.js in remarkable 1.7.1 allows Regular Expression Denial of Service (ReDoS) via a CDATA section.

Recommendation

Update the remarkable package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.7.2
• Patched version(s): 1.7.2

References

• GHSA-q22g-8fr4-qpj4
• snyk.io
• CVE-2019-12041
• CWE-1333
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Regular Expression Denial of Service in Handlebars - CVE-2019-20922
• Regular Expression Denial of Service (ReDoS) in lodash - lodash-amd - CVE-2019-1010266
• Regular Expression Denial of Service (ReDoS) in lodash - lodash-es - GHSA-x5rq-j2xg-h7qm - CVE-2019-1010266
• Regular Expression Denial of Service (ReDoS) in lodash - lodash - CVE-2019-1010266

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

remarkable