Regular Expression Denial of Service in riot-compiler

ALTO 7.5CVE-2016-10527 · GHSA-pp4v-55vr-9gxh · Published 31/05/2018 · updated 17/06/2026

In breve

CVE-2016-10527 è una vulnerabilità ALTO (CVSS 7.5) che riguarda riot-compiler (riot.js), riot-compiler.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.6%, superiore al 75.6% delle vulnerabilità.
Correzione: aggiornare a 2.3.22 o successiva.

Package	Affected versions	Patched versions
riot-compiler riot.js	`= 2.3.21`	No fix yet
riot-compiler npm	`< 2.3.22`	`2.3.22`

Affected versions of riot-compiler are susceptible to a regular expression denial of service vulnerability.

Update to version 2.3.22 or later.

NVD description

The riot-compiler version version 2.3.21 has an issue in a regex (Catastrophic Backtracking) thats make it unusable under certain conditions.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.