CVEs-PoC/2022/CVE-2022-25883.md

CVE-2022-25883

Description

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

POC

Reference

• https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795

Github

• https://github.com/bottledlactose/dungoid
• https://github.com/bottledlactose/isditeengrap.nl
• https://github.com/dellalibera/dellalibera
• https://github.com/mathworks/MATLAB-language-server
• https://github.com/seal-community/cli
• https://github.com/seal-community/patches
• https://github.com/tmalbonph/grunt-swagger-tools
• https://github.com/trong0dn/eth-todo-list