Regular Expression Denial of Service Vulnerability (CVE-2024-4067)

[lumadev]

Describe the bug

unplugin-vue-components is vulnerable to Regular Expression Denial of Service attack. The following description of GitHub Advisory Database explains:

The NPM package micromatch is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in micromatch.braces() in index.js because the pattern .* will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching.

Vulnerable package: micromatch

Path: unplugin-vue-components > fast-glob > micromatch

Reproduction

Execute 'npm audit' in a project with unplugin-vue-components installed

System Info

System:
    OS: Windows 11
  Binaries:
    Node: 21.6.1
    Yarn: 1.22.4
    npm: 10.2.4

Used Package Manager

yarn

Validations

• Follow our Code of Conduct
• Read the Contributing Guide.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Check that this is a concrete bug. For Q&A, please open a GitHub Discussion instead.
• The provided reproduction is a minimal reproducible of the bug.

[VividLemon]

The package only runs during the build process. If one were to exploit the issue, it would only impact the developer. Which is why npm audit can be misleading https://overreacted.io/npm-audit-broken-by-design/