Change Request: Vulnerability detected: Regular Expression Denial of Service (ReDoS) via the parseJSONLikeConfig function in the ConfigCommentParser class

[igorgiumellizup]

Environment

ESLint version:
@eslint/css version: 0.10.0
Node version: 23.6.1
npm version: 11.1.0
Operating System: Linux, macOS, Windows

According to Synk report and this GitHub report:

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the parseJSONLikeConfig function in the ConfigCommentParser class. An attacker can cause excessive CPU consumption and block execution by providing specially crafted input that triggers inefficient regular expression processing

The reports above mention @eslint/plugin-kit, but apparently the following libs introduce the vulnerability

"@eslint/css": "^0.10.0",
"@eslint/json": "^0.13.0",
"@eslint/markdown": "^7.0.0",

What problem do you want to solve?

Vulnerability

What do you think is the correct solution?

Review the code mentioned in the reports.

Participation

• I am willing to submit a pull request for this change.

Additional comments

No response

[igorgiumellizup]

https://github.com/eslint/eslint/security/advisories/GHSA-rxwv-hcxh-mh7f

[lumirlumir]

Hi @igorgiumellizup,

I’ve left a comment on eslint/markdown#484 (comment) regarding the same issue.