CVE-2022-37262 - A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the source and sourceWithComments variable in main.js

HIGH

A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the source and sourceWithComments variable in main.js

Published Sep 15, 2022

7.5

HIGH

CVSS 3.1

EPSS 1.38%

A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the source and sourceWithComments variable in main.js.

Ecosystem	Package	Introduced	Fixed
npm	steal	0	not fixed

No remediation recorded yet.

Weaknesses (1)

CWE-1333

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6658		Advisory
https://github.com/advisories/GHSA-28v4-jf82-jvj8		Advisory
https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/main.js#L3497		x_refsource_MISCThird Party Advisory
https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/main.js#L3507		x_refsource_MISCThird Party Advisory
https://github.com/stealjs/steal/issues/1531		x_refsource_MISCIssue TrackingThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-37262