VDB
Sign up
MEDIUM5.3

GHSA-hhfg-6hfc-rvxm

Regular Expression Denial of Service in jsoneditor

Quick fix

GHSA-hhfg-6hfc-rvxm — jsoneditor: upgrade to the fixed version with the command below.

npm install jsoneditor@9.5.6

Details

JSON Editor is a web-based tool to view, edit, format, and validate JSON. It has various modes such as a tree editor, a code editor, and a plain text editor. The jsoneditor package is vulnerable to ReDoS (regular expression denial of service). An attacker that is able to provide a crafted element as input to the getInnerText function may cause an application to consume an excessive amount of CPU. Below pinned line using vulnerable regex.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/jsoneditor
Introduced in: 0Fixed in: 9.5.6
Fixnpm install jsoneditor@9.5.6

References