Regular Expression Denial of Service (ReDoS) on dependency 'word-wrap'

[Globant-Eduardo-Cerda]

Based on this post

Software like snyk / DependencyTrack are yielding a ReDoS on the word-wrap package. This affects you because of the direct dependency on your project.

[icbat]

Thread from word-wrap for reference. It's unclear when/if that's going to be fixed at the library level, at time of writing I haven't seen anything from the maintainer in that thread yet.

[SharpFu]

I have meet this issue.

[SharpFu]

@gkz , If you have free time ,pls help to fix this issue. thanks.

[gkz]

What issue did you actually encounter?
The author of the CLI tool using Optionator would need to purposefully make a bad description. It doesn't operate on user generated input. You could simply not use that CLI tool?
I understand the theoretical problem, and am happy to update to another package, but I'm just not understanding the actual issue in practice.

[icbat]

For me at least, I don't think there really is an actual technical issue. The problem I'm hitting is that some organizations treat all CVEs the same. My personal use-case is using eslint; which doesn't have a lot of surface area for a real ReDoS vector. However, it still flags the same as anything else, and I am still required to remediate (or file exceptions, etc.).

[gkz]

Does anyone have a suggestion for an alternate package?

(I've already had to change the word wrap package once already, when the original one had licensing issues!)

[SharpFu]

@gkz I am used "eslint": "^7.14.0" and when I use snyk check my project. and then throw a error as the image

[gkz]

I mean an alternative for word-wrap

[rhuddleston]

wordwrapjs maybe?

[wellwelwel]

Does anyone have a suggestion for an alternate package?

---

Hi @gkz.

For now, I think the @aashutoshrathi's word-wrap fork is a good alternative, because it only changes a single fix focused on the vulnerability. In other words, it won't break anything.

You can comparing changes here and see the @aashutoshrathi's npm package.

Regardless, I see this as a temporary measure.

---

References:

• 🔒 fix: CVE-2023-26115 jonschlinkert/word-wrap#33
• Give admin privileges to somebody else  jonschlinkert/word-wrap#39

[gkz]

I have published 0.9.2 that should resolve the issue.

Thanks @wellwelwel for the tip.

[devpeerapong]

Did you publish the package to npm ?
Sorry, I just hit refresh and it's there.
Thanks, Great job @gkz !

[wellwelwel]

Hi, @gkz 🙋🏻‍♂️

As before in my comment:

Regardless, I see this as a temporary measure.

I would just like to say that the security issue has been solved in the original word-wrap project today 🎉

---

Related:

• 🔒 fix: CVE-2023-26115 jonschlinkert/word-wrap#33
• 🔒fix: CVE 2023 26115 (2) jonschlinkert/word-wrap#41
• FYI: a clone of word-wrap now exists jonschlinkert/word-wrap#43