CVE-2025-5889

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-5889
A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.

3.1 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

2.1 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:N/AC:H/Au:S/C:N/I:N/A:P

Exploitability : 3.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466
https://github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5
https://github.com/juliangruber/brace-expansion/releases/tag/v4.0.1
https://vuldb.com/?ctiid.311660
https://vuldb.com/?id.311660
https://vuldb.com/?submit.585717
Configurations

No configuration.

History

11 Jun 2025, 11:15

Type Values Removed Values Added
Summary
  • (es) Se encontró una vulnerabilidad en juliangruber brace-expansion hasta la versión 1.1.11. Se ha clasificado como problemática. Este problema afecta a la función "expand" del archivo index.js. La manipulación genera una complejidad ineficiente en las expresiones regulares. El ataque puede ejecutarse en remoto. Es un ataque de complejidad bastante alta. Parece difícil de explotar. Se ha hecho público el exploit y puede que sea utilizado. El parche se llama a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. Se recomienda aplicar un parche para solucionar este problema.
Summary (en) A vulnerability was found in juliangruber brace-expansion up to 1.1.11. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to apply a patch to fix this issue. (en) A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.
References
  • () https://github.com/juliangruber/brace-expansion/releases/tag/v4.0.1 -

09 Jun 2025, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-09 19:15

Updated : 2025-06-12 16:06

NVD link : CVE-2025-5889

Mitre link : CVE-2025-5889

CVE.ORG link : CVE-2025-5889

JSON object : View

Products Affected

No product.

CWE
CWE-400

Uncontrolled Resource Consumption

CWE-1333

Inefficient Regular Expression Complexity