Muhammadyusuf Dilmurodov

PapaParse before 5.7.1 contains an inefficient algorithmic complexity vulnerability that allows remote unauthenticated attackers to cause denial of service by submitting delimiter-free quoted CSV input to Papa.parse(). Attackers can supply a single-column quoted CSV with no delimiters, triggering repeated full-buffer indexOf scans per row that grow quadratically with input size, exhausting CPU and blocking the Node.js event loop or freezing a browser tab.

plist.js (npm package 'plist') before 5.0.1 contains an uncontrolled resource consumption vulnerability in the binary property-list parser (parseBinary) that allows unauthenticated attackers to crash a Node.js process by exploiting unmemoized recursive resolution of shared object references for arrays and dictionaries. Attackers can craft a small binary plist (under 200 bytes) containing chained self-referencing object indices to trigger exponential (2^N) resolution calls and memory growth, causing an unrecoverable out-of-memory crash and denial of service.

An algorithmic complexity issue exists in inline link parsing. Remote attackers can cause CPU exhaustion by submitting short Markdown content containing repeated `[` or `![` characters. This forces the `getText()` and `getLink()` functions within `LinkInlineProcessor` into quadratic scans, which can keep worker processes busy for several minutes.

A denial of service issue exists where remote users can exhaust CPU resources by submitting Markdown containing unclosed inline link destinations. By providing repeated '[a](' or '` function rescans the remaining document for each link, resulting in quadratic CPU time consumption.