jsx-slack is a library for building JSON objects for Slack Block Kit surfaces from JSX. In versions prior to 4.5.1 users are vulnerable to a regular expression denial-of-service (ReDoS) attack. If attacker can put a lot of JSX elements into `<blockquote>` tag, an internal regular expression for escaping characters may consume an excessive amount of computing resources. jsx-slack v4.5.1 has patched to a regex for escaping blockquote characters. Users are advised to upgrade as soon as possible.
References
| Link | Resource |
|---|---|
| https://github.com/yhatt/jsx-slack/commit/36e4a10405e4c7745333e245fcc5029c02c7065d | Patch Third Party Advisory |
| https://github.com/yhatt/jsx-slack/security/advisories/GHSA-55xv-f85c-248q | Exploit Patch Third Party Advisory |
| https://github.com/yhatt/jsx-slack/commit/36e4a10405e4c7745333e245fcc5029c02c7065d | Patch Third Party Advisory |
| https://github.com/yhatt/jsx-slack/security/advisories/GHSA-55xv-f85c-248q | Exploit Patch Third Party Advisory |
Configurations
History
21 Nov 2024, 06:29
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/yhatt/jsx-slack/commit/36e4a10405e4c7745333e245fcc5029c02c7065d - Patch, Third Party Advisory | |
| References | () https://github.com/yhatt/jsx-slack/security/advisories/GHSA-55xv-f85c-248q - Exploit, Patch, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 5.3 |
21 Jul 2023, 16:45
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-1333 |
Information
Published : 2021-12-17 19:15
Updated : 2024-11-21 06:29
NVD link : CVE-2021-43838
Mitre link : CVE-2021-43838
CVE.ORG link : CVE-2021-43838
JSON object : View
Products Affected
jsx-slack_project
- jsx-slack