Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @sync-in/server | npm | <= 2.3.0 | 2.4.0 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-58270, is a Regular Expression Denial of Service (ReDoS) in the Sync-in Server. The core issue lies in the server's handling of user-provided pathFilters in the POST /api/app/sync/operation/diff/:id endpoint. Specifically, the SyncDiffDto class, located in backend/src/applications/sync/dtos/sync-operations.dto.ts, used an @Transform decorator on its pathFilters property. In the vulnerable version, this decorator directly instantiated a RegExp object from user input without any checks for regex complexity or safety. This allowed an attacker to inject a specially crafted regular expression (e.g., ^(a+)+b). Subsequently, this maliciously crafted RegExp object's test() method was called in backend/src/applications/sync/services/sync-manager.service.ts during the sync diff traversal. Because RegExp.test() is a synchronous operation, evaluating a catastrophic backtracking pattern against a worst-case input (a long string of 'a's in this example) would consume excessive CPU resources, blocking the Node.js event loop and rendering the server unresponsive to other requests, thus causing a Denial of Service. The patch addresses this by introducing a transformPathFilters utility function that performs validation (length check, syntax check, and safety check using safe-regex2) before creating the RegExp object. The SyncDiffDto.pathFilters is the point where the malicious regex is created from user input, and RegExp.test is the function that executes the regex, leading to the ReDoS.
SyncDiffDto.pathFiltersbackend/src/applications/sync/dtos/sync-operations.dto.ts
RegExp.testbackend/src/applications/sync/services/sync-manager.service.ts