High · 7.5 CVE-2022-37262 EUVD-2022-6658GHSA-28v4-jf82-jvj8

steal vulnerable to Regular Expression Denial of Service via source and sourceWithComments

Published Sep 15, 2022 · Updated Aug 3, 2024 · Assigned by mitre

Description

A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the source and sourceWithComments variable in main.js.

Ecosystem	Package	Affected	Fixed	Record
npm	steal	<= 2.3.0	—	GHSA-28v4-jf82-jvj8