CVE-2023-30858CWE-1333

Denosaurs emoji has ReDoS vulnerability in `replace` function

Medium · published April 28, 2023

CVSS v3.1
5.3
EPSS
1%
Percentile
67.0
In the wild
Unconfirmed
What it is

The Denosaurs emoji package provides emojis for dinosaurs. Starting in version 0.1.0 and prior to version 0.3.0, the reTrimSpace regex has 2nd degree polynomial inefficiency, leading to a delayed response given a big payload. The issue has been patched in 0.3.0. As a workaround, avoid using the `replace`, `unemojify`, or `strip` functions.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.01162 · 67.0th percentile
Weakness
CWE-1333 · Inefficient Regular Expression Complexity
Published
2023-04-28T20:49Z
EPSS history
Timeline
  • 28 APR 20:49Z
    Denosaurs emoji has ReDoS vulnerability in `replace` function
    cvelistv5