Incomplete in the CWE catalog · 2 CVEs mapped
The product uses a regular expression that either (1) contains an executable component with user-controlled inputs, or (2) allows a user to enable execution by inserting pattern modifiers.
🚨 A little PHP magic in the wrong hands could spell disaster! Before version 1.33.0, PEAR's preg_replace() function was like an open stage for attackers, allowing them to execute PHP code with just a little crafty input. 🔥 Think of it like a restaurant where the chef blindly follows any recipe handed to them — an attacker could submit a recipe filled with harmful ingredients, and the chef would unknowingly whip up a toxic dish for everyone to consume. If an attacker can get their hands on the evaluated replacement, they could run arbitrary PHP code on your server! This could lead to unauthorized access, data leaks, or even full system compromise — a nightmare scenario for any developer. 😱
TF2 Item Format helps users format TF2 items to the community standards. Versions of `tf2-item-format` since at least `4.2.6` and prior to `5.9.14` are vulnerable to a Regular Expression Denial of Service (ReDoS) attack when parsing crafted user input. This vulnerability can be exploited by an attacker to perform DoS attacks on any service that uses any `tf2-item-format` to parse user input. Version `5.9.14` contains a fix for the issue.