ReDoS Vulnerability in shellwords #13
Description
Vulnerability type
RegExp Denial-of-Service——catastrophic backtracking in regex evaluation
Vulnerability Location
In the split function of [email protected], the following regular expression is used:
/\s*(?:([^\s\\'"]+)|'((?:[^'\\]|\\.)*)'|"((?:[^"\\]|\\.)*)"|(\\.?)|(\S))(\s|$)?/Description
The split function in shellwords uses a complex regular expression to tokenize shell-like input strings.
However, this regex is vulnerable to catastrophic backtracking, which can cause CPU exhaustion and application hang when processing specially crafted input.
Proof of Concept (PoC)
require("shellwords").split('\n' + ' '.repeat(100000))Affected version
[email protected]
(Other versions using the same regex implementation may also be affected)