-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability explicitly references the braceExpand function in CVE-2022-3517's description. The commit diff shows the regex check in braceExpand was tightened from /{.}/ to /{(?:(?!{).)}/, which prevents catastrophic backtracking. The addition of assertValidPattern with MAX_PATTERN_LENGTH further mitigates ReDoS by limiting input size. CWE-1333 (Inefficient Regex) and CWE-400 (Resource Consumption) directly map to this function's pre-patch behavior.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| minimatch | npm | < 3.0.5 | 3.0.5 |
Ongoing coverage of React2Shell