steal Inefficient Regular Expression Complexity vulnerability via string variable

Description

A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the string variable in babel.js.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 2.3.0

References

• GHSA-rgqx-226f-2xp4
• CVE-2022-37259
• CWE-1333
• CAPEC-310
• OWASP 2021-A6

Related Issues

• string-kit Inefficient Regular Expression Complexity vulnerability - CVE-2021-4299
• steal vulnerable to Regular Expression Denial of Service via input variable - CVE-2022-37260
• axios Inefficient Regular Expression Complexity vulnerability - CVE-2021-3749
• steal vulnerable to Regular Expression Denial of Service via source and sourceWithComments - CVE-2022-37262

Tags:

npm

steal