CVE-2021-23362 @ Npm-hosted-git-info-2.1.5

[CMaheshBL]

Vulnerable Package issue exists @ Npm-hosted-git-info-2.1.5 in branch master

Hosted-git-info versions prior to 2.8.9, and 3.0.x prior to 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.

Namespace: CMaheshBL
Repository: NodeGoat
Repository Url: https://github.com/CMaheshBL/NodeGoat
CxAST-Project: CMaheshBL/NodeGoat
CxAST platform scan: d7c1c0af-6b2d-455e-8753-a6b87dbf733d
Branch: master
Application: NodeGoat
Severity: MEDIUM
State: NOT_IGNORED
Status: RECURRENT
CWE: CWE-400

---

Addition Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: NONE
Availability impact: LOW
Remediation Upgrade Recommendation: 2.8.9

---

References
Advisory
Pull request
Commit