Regular Expression Denial of Service in minimatch
High severity
GitHub Reviewed
Published
Oct 9, 2018
to the GitHub Advisory Database
•
Updated Sep 11, 2023
Description
Published to the GitHub Advisory Database
Oct 9, 2018
Reviewed
Jun 16, 2020
Last updated
Sep 11, 2023
Affected versions of
minimatch
are vulnerable to regular expression denial of service attacks when user input is passed into thepattern
argument ofminimatch(path, pattern)
.Proof of Concept
Recommendation
Update to version 3.0.2 or later.
References