Homepage

jsx-slack@4.4.2 vulnerabilities

Build JSON object for Slack Block Kit surfaces from JSX

  • latest version

    6.1.2

  • latest non vulnerable version

    6.1.2

  • first published

    3 years ago

  • latest version published

    1 months ago

  • licenses detected

  • View jsx-slack package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the jsx-slack package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Regular Expression Denial of Service (ReDoS)

    jsx-slack is a Build JSON object for Slack Block Kit surfaces from JSX

    Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). When inserting a lot of JSX elements with multibyte characters into a<blockquote> tag, an internal regular expression for escaping characters may consume an excessive amount of computing resources.

    Note:: This vulnerability exists due to incomplete fix of CVE-2021-43838.

    How to fix Regular Expression Denial of Service (ReDoS)?

    Upgrade jsx-slack to version 4.5.2 or higher.

    <4.5.2
    • L
    Regular Expression Denial of Service (ReDoS)

    jsx-slack is a Build JSON object for Slack Block Kit surfaces from JSX

    Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) if an attacker is able to insert many JSX elements into a <blockquote> tag.

    How to fix Regular Expression Denial of Service (ReDoS)?

    Upgrade jsx-slack to version 4.5.1 or higher.

    <4.5.1
    Go back to all versions of this package