eslint @eslint/plugin-kit vulnerabilities

Latest eslint @eslint/plugin-kit CVEs

Newest publication first

1. GHSA-xffm-g5w8-qvg7 @eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser

   Published 2025-07-18

   Low·CVSS 2.3

   Summary The ConfigCommentParser#parseJSONLikeConfig API is vulnerable to a Regular Expression Denial of Service (ReDoS) attack in its only argument. Details The regular expression at packages/plugin-kit/src/config-comment-parser.js:158 is vulnerable to a quadratic runtime attack...

2. CVE-2024-21539 Regular Expression Denial of Service (ReDoS) in @eslint/plugin-kit

   Published 2024-11-19

   High·CVSS 8.7 EPSS 0.51%

   Versions of the package @eslint/plugin-kit before 0.2.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by exploiting this vulnerability.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.