Summary
ember-cli-htmlbars@7.0.0 depends on multiple vulnerable versions of minimatch (3.1.2, 9.0.5), which are vulnerable to Regular Expression Denial of Service (ReDoS) (High severity).
Vulnerability Details
Affected versions of minimatch are vulnerable to ReDoS in the AST class, caused by catastrophic backtracking when an input string contains many * characters in a row followed by an unmatched character.
Example Affected Dependency Paths
minimatch is pulled in through multiple paths in ember-cli-htmlbars@7.0.0:
| # |
Dependency Path |
| 1 |
ember-cli-htmlbars → walk-sync@4.0.1 → matcher-collection@2.0.1 → minimatch@3.1.2 |
| 2 |
ember-cli-htmlbars → broccoli-plugin@4.0.7 → rimraf@3.0.2 → glob@7.2.3 → minimatch@3.1.2 |
| 3 |
ember-cli-htmlbars → broccoli-persistent-filter@3.1.3 → rimraf@3.0.2 → glob@7.2.3 → minimatch@3.1.2 |
| 4 |
ember-cli-htmlbars → broccoli-plugin@4.0.7 → quick-temp@0.1.9 → rimraf@5.0.10 → glob@10.5.0 → minimatch@9.0.5 |
|
few more... |
Potential Remediation
- Fix has been given in minimatch to version 10.2.1 or higher. Upgrade transitive dependencies that pull in vulnerable
minimatch versions — particularly broccoli-plugin, broccoli-persistent-filter, broccoli-debug, walk-sync, rimraf, and glob — to versions that depend on minimatch@>=10.2.1
References
Summary
ember-cli-htmlbars@7.0.0depends on multiple vulnerable versions ofminimatch(3.1.2,9.0.5), which are vulnerable to Regular Expression Denial of Service (ReDoS) (High severity).Vulnerability Details
Affected versions of
minimatchare vulnerable to ReDoS in theASTclass, caused by catastrophic backtracking when an input string contains many*characters in a row followed by an unmatched character.Example Affected Dependency Paths
minimatchis pulled in through multiple paths inember-cli-htmlbars@7.0.0:ember-cli-htmlbars→walk-sync@4.0.1→matcher-collection@2.0.1→minimatch@3.1.2ember-cli-htmlbars→broccoli-plugin@4.0.7→rimraf@3.0.2→glob@7.2.3→minimatch@3.1.2ember-cli-htmlbars→broccoli-persistent-filter@3.1.3→rimraf@3.0.2→glob@7.2.3→minimatch@3.1.2ember-cli-htmlbars→broccoli-plugin@4.0.7→quick-temp@0.1.9→rimraf@5.0.10→glob@10.5.0→minimatch@9.0.5Potential Remediation
minimatchversions — particularlybroccoli-plugin,broccoli-persistent-filter,broccoli-debug,walk-sync,rimraf, andglob— to versions that depend onminimatch@>=10.2.1References