MEDIUM
GHSA-jgvr-6x5w-hx5w
Zoo Design Studio: Recursive KCL parsing is vulnerable to denial-of-service
Quick fix
GHSA-jgvr-6x5w-hx5w — zoo-kcl: upgrade to the fixed version with the command below.
pip install --upgrade 'zoo-kcl>=0.3.129'Details
### Impact Feeding a KCL program that wraps an expression in deep, unnecessary parentheses triggers the parser’s recursive `expression` -> `unnecessarily_bracketed` -> `expression` path. With enough nesting, the call stack grows until it exceeds the process stack limit, causing a stack overflow.
Are you affected?
Enter the version of the package you're using.
Affected packages
crates.io / kcl-lib
Introduced in:
0 Fixed in: 0.3.129 Upgrade kcl-lib to 0.3.129 or newer (ecosystem crates.io).