-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| react-native-reanimated | npm | < 2.10.0 | 2.10.0 |
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability stems directly from the regex pattern defined in the NUMBER constant within Colors.ts, as shown in the commit diff. This regex was used for validating numeric components in color values (like RGB/A, HSL/A). The original pattern contained ambiguous quantifiers (\d* and .?) that permitted multiple evaluation paths, enabling ReDoS attacks when matching attacker-controlled strings. The patched commit specifically addresses this by restructuring the regex to eliminate ambiguous paths while maintaining functionality.
Ongoing coverage of React2Shell