pkg
pkg copied to clipboard
"CVE-2021-3807" detected in dependent package
It seems like there is vulnerability in pkg.
Body: [
{
"name": "ansi-regex",
"version": "2.1.1",
"vulnerabilities": [
{
"title": "Regular Expression Denial of Service (ReDoS)",
"risk_level": 0,
"severity": "high",
"remediation": "3.0.1",
"cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"reported_at": "2021-09-12T12:52:37Z",
"stdcode": [
"CVE-2021-3807"
],
"description": "Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the sub-patterns` [[\\\\]()#;?]*` and `(?:;[-a-zA-Z\\\\d\\\\/#\u0026.:=?%@~_]*)*`.\r\n\r\n\r\n### PoC\r\n```js\r\nimport ansiRegex from 'ansi-regex';\r\n\r\nfor(var i = 1; i \u003c= 50000; i++) {\r\n var time = [Date.now](http://date.now/)();\r\n var attack_str = \"\\u001B[\"+\";\".repeat(i*10000);\r\n ansiRegex().test(attack_str)\r\n var time_cost = [Date.now](http://date.now/)() - time;\r\n console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\r\n}\r\n```",
"updated_at": "2022-07-07T14:12:59.277135Z",
"references": null,
"url": "https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908",
"id": "SNYK-JS-ANSIREGEX-1583908"
}
],
"vulnerable": true,
"ecosystem": "js"
We see that it has been fixed in dependent packages of [email protected]. Can you please take and update the package.