Meet Corgea at Black Hat, BSides Las Vegas & DEF CON
Start for Free
MEDIUM 5.3 npm

Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing

GHSA-rmmh-p597-ppvv · CVE-2024-1899

Published · Modified

Description

Showdownjs, versions <= 2.1.0, anchors subparser used to parse links has a nested regular expression which can lead to denial of service conditions given malicious input.

References

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes