N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-54363

CVE-2025-54363: Microsoft Knack ReDoS Vulnerability in the Introspection Module

Microsoft Knack 0.12.0 allows Regular expression Denial of Service (ReDoS) in the knack.introspection module (issue 1 of 2).

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-54363

CVE-2025-54363:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
knack	pip	<= 0.12.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the knack.introspection module and is due to an inefficient regular expression that can be exploited for a Denial of Service (DoS) attack. The analysis of the provided GitHub issue and the commit that introduced the feature confirms the vulnerability. The issue explicitly points out the problematic regex r'\s*(:param)\s+(.+?)\s*:(.*)' and the file knack/introspection.py where it is used. The commit 430c39e657d8a424ef9b631782fe0e62a6bed203 introduced the file clicore/introspection.py (which was later renamed to knack/introspection.py) and the two functions extract_full_summary_from_signature and option_descriptions. Both of these functions utilize the vulnerable regular expression to parse docstrings. An attacker can provide a malicious docstring that causes the regex engine to backtrack catastrophically, consuming significant CPU resources and making the application unresponsive. Therefore, these two functions are identified as the vulnerable functions.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.