jsx-slack is a library for building JSON objects for Slack Block Kit surfaces from JSX. In versions prior to 4.5.1 users are vulnerable to a regular expression denial-of-service (ReDoS) attack. If attacker can put a lot of JSX elements into `<blockquote>` tag, an internal regular expression for escaping characters may consume an excessive amount of computing resources. jsx-slack v4.5.1 has patched to a regex for escaping blockquote characters. Users are advised to upgrade as soon as possible.
References
| Link | Resource |
|---|---|
| https://github.com/yhatt/jsx-slack/commit/36e4a10405e4c7745333e245fcc5029c02c7065d | Patch Third Party Advisory |
| https://github.com/yhatt/jsx-slack/security/advisories/GHSA-55xv-f85c-248q | Exploit Patch Third Party Advisory |
Configurations
History
21 Jul 2023, 16:45
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-1333 |
03 Jan 2022, 13:24
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-Other | |
| References | (MISC) https://github.com/yhatt/jsx-slack/commit/36e4a10405e4c7745333e245fcc5029c02c7065d - Patch, Third Party Advisory | |
| References | (CONFIRM) https://github.com/yhatt/jsx-slack/security/advisories/GHSA-55xv-f85c-248q - Exploit, Patch, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 7.5 |
| CPE | cpe:2.3:a:jsx-slack_project:jsx-slack:*:*:*:*:*:node.js:*:* |
17 Dec 2021, 19:42
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-12-17 19:15
Updated : 2024-02-04 22:08
NVD link : CVE-2021-43838
Mitre link : CVE-2021-43838
CVE.ORG link : CVE-2021-43838
JSON object : View
Products Affected
jsx-slack_project
- jsx-slack