Last tested: 20 Feb, 2018

yargs vulnerabilities

yargs the modern, pirate-themed, successor to optimist.

View on npm

yargs (latest)

Published 18 Feb, 2018

Known vulnerabilities0
Vulnerable paths0
Dependencies50

No known vulnerabilities in yargs

Security wise, yargs seems to be a safe package to use.
Over time, new vulnerabilities may be disclosed on yargs and other packages. To easily find, fix and prevent such vulnerabilties, protect your repos with Snyk!

Vulnerable versions of yargs

Fixed in 3.4.4

Regular Expression Denial of Service (ReDoS)

medium severity
  • Vulnerable module: string
  • Introduced through: string@3.3.3

Detailed paths

  • Introduced through: yargs@3.4.0 > string@3.3.3

Overview

string is a JavaScript library for extra String methods.

Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS). It uses regex in the underscore and unescapeHTML methods, which can cause a slowdown of 2 seconds 50k characters.

The Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Many Regular Expression implementations may reach extreme situations that cause them to work very slowly (exponentially related to input size), allowing an attacker to exploit this and can cause the program to enter these extreme situations by using a specially crafted input and cause the service to excessively consume CPU, resulting in a Denial of Service.

You can read more about Regular Expression Denial of Service (ReDoS) on our blog.

Remediation

There is no fix version for string.

References