CVE-2024-21539

Name of the Vulnerable Software and Affected Versions @eslint/plugin-kit versions prior to 0.2.3

Description The issue is related to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by exploiting this vulnerability. Crafting a very large and well-crafted string can also increase the CPU usage and crash the program.

Recommendations For versions prior to 0.2.3, update to version 0.2.3 or later to resolve the issue. As a temporary workaround, consider restricting the input size to prevent large strings from being processed by the ConfigCommentParser function. Avoid using the ConfigCommentParser function with untrusted input until the issue is resolved.