-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from two key functions handling regex processing: 1) AST_RegExp evaluation in evaluate.js previously lacked regexp_is_safe validation, allowing dangerous patterns. 2) AST_Call optimization in index.js created RegExp instances from parameters without safety checks. The patches explicitly added regexp_is_safe checks to both locations, indicating these were the vulnerable points. The CWE-1333 classification and commit messages confirm these were the ReDoS entry points through unsafe regex construction/evaluation.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| terser | npm | < 4.8.1 | 4.8.1 |
| terser | npm | >= 5.0.0, < 5.14.2 | 5.14.2 |
JavaScriptJavaScriptOngoing coverage of React2Shell