-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the regex pattern used in preg_split within convert_urls_into_links. The original regex '(/(<[^>]>)/i)' is prone to ReDoS due to inefficient handling of nested/unclosed tags. The commit patched this by modifying the regex to '(/(<[^<|>]>)/i)' and adjusted HTML detection logic, explicitly addressing the ReDoS vector. Unit tests added in the commit further validate the fix targets this function's behavior.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | < 2.6.9 | 2.6.9 |
| moodle/moodle | composer | >= 2.7.0, < 2.7.6 | 2.7.6 |
| moodle/moodle | composer | >= 2.8.0, < 2.8.4 | 2.8.4 |