brace-expansion@2.1.2

brace-expansion is a Brace expansion as known from sh/bash

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the expand(), expand_(), combine(), and expandSequence() functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent maxLength allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores maxLength and does work proportional to max * width. Exploitation requires the application to pass untrusted input to expand(), directly or transitively through a glob or pattern-matching library.

Upgrade brace-expansion to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.