jsx-slack is a library for building JSON objects for Slack Block Kit surfaces from JSX. In versions prior to 4.5.1 users are vulnerable to a regular expression denial-of-service (ReDoS) attack. If attacker can put a lot of JSX elements into `<blockquote>` tag, an internal regular expression for escaping characters may consume an excessive amount of computing resources. jsx-slack v4.5.1 has patched to a regex for escaping blockquote characters. Users are advised to upgrade as soon as possible.
References
Link | Resource |
---|---|
https://github.com/yhatt/jsx-slack/commit/36e4a10405e4c7745333e245fcc5029c02c7065d | Patch Third Party Advisory |
https://github.com/yhatt/jsx-slack/security/advisories/GHSA-55xv-f85c-248q | Exploit Patch Third Party Advisory |
Configurations
History
21 Jul 2023, 16:45
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-1333 |
Information
Published : 2021-12-17 19:15
Updated : 2024-02-28 18:48
NVD link : CVE-2021-43838
Mitre link : CVE-2021-43838
CVE.ORG link : CVE-2021-43838
JSON object : View
Products Affected
jsx-slack_project
- jsx-slack