Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@chenglou/pretext

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.7npmAmendedPublished

    Pretext: Algorithmic Complexity (DoS) in the text analysis phase

    GHSA-5478-66c3-rhxr

    Affected
    • npm @chenglou/pretext <= 0.0.4
    Fixed in
    0.0.5· Vendor fix available
    Issue
    isRepeatedSingleCharRun() in src/analysis.ts (line 285) re-scans the entire accumulated segment on every merge iteration during text analysis, producing O(n²) total work for input consisting of repeated identical punctuation characters. An attacker who controls text passed to prepare() can block the main thread for ~20 seconds with 80KB of input (e.g., "(".repeat(80000)). Tested against commit 9364741d3562fcc65aacc50953e867a5cb9fdb23 (v0.0.4) on Node.js v24.12.0, Windows x64. A standalone PoC and detailed write-up are attached below. --- Root Cause The buildMergedSegmentation() function (line 795) processes text segments produced by Intl.Segmenter. When consecutive non-word-like segments consist of the same single character (e.g., (, , !, #), the code merges them into one growing segment (line 859): Before each merge, it calls isRepeatedSingleCharRun() (line 857) to verify that ALL characters in the accumulated segment match the new character: Intl.Segmenter with granularity: 'word'…

    Recommended action: Upgrade to 0.0.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →