Which versions of @eslint/plugin-kit are affected by CVE-2024-21539?

@eslint/plugin-kit before version 0.2.3 contains a denial-of-service vulnerability that could halt build pipelines and disrupt CI/CD workflows when malicious configurations are supplied.. A patch is available.

How to fix or mitigate CVE-2024-21539?

Within 24 hours, scan all development environments and CI/CD pipelines to identify @eslint/plugin-kit versions before 0.2.3 using tools like `npm ls @eslint/plugin-kit` or automated dependency analysis. Within 7 days, upgrade @eslint/plugin-kit to version 0.2.3 or later in all affected projects, update lockfiles, and validate that builds execute without regression. Within 30 days, establish continuous dependency monitoring through software composition analysis (SCA) tools to detect vulnerable versions of critical build-time dependencies like ESLint plugins, and implement automated alerts for new CVEs affecting your dependency tree.

@eslint/plugin-kit CVE-2024-21539

Q: What is the CVSS score of CVE-2024-21539?

CVE-2024-21539 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

HIGH

Inefficient Regular Expression Complexity (ReDoS) (CWE-1333)

2024-11-19 report@snyk.io

Denial Of Service

7.7

CVSS 4.0 · Vendor: snyk

Severity by source

Vendor (snyk) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network reachable via file submission to CI systems; no privileges or interaction needed; impact is availability-only with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (snyk).

CVSS VectorVendor: snyk

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 03, 2026 - 16:29 vuln.today

Analysis Updated

Aug 03, 2026 - 16:29 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 03, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

Aug 03, 2026 - 16:22 NVD

7.5 (HIGH) 7.7 (HIGH)

CVE Published

Nov 19, 2024 - 05:15 cve.org

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on @eslint/plugin-kit (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 0.2.3.

DescriptionCVE.org

Versions of the package @eslint/plugin-kit before 0.2.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by exploiting this vulnerability.

AnalysisAI

Regular Expression Denial of Service in @eslint/plugin-kit before 0.2.3 allows CPU exhaustion and process crash by supplying maliciously crafted ESLint inline comment configuration strings. The vulnerable ConfigCommentParser.parseStringConfig method applied the regex /\s*([:,])\s*/gu to unsanitized input without first trimming whitespace, enabling catastrophic backtracking when strings contain large runs of whitespace adjacent to colons or commas. A proof-of-concept exploit is confirmed (CVSS 4.0 E:P supplemental metric), though EPSS of 0.48% at the 38th percentile indicates no observed widespread exploitation and this is not in CISA KEV.

Technical ContextAI

The root cause is CWE-1333 (Inefficient Regular Expression Complexity) within the ConfigCommentParser class in packages/plugin-kit/src/config-comment-parser.js of the ESLint rewrite monorepo. The method parseStringConfig - responsible for parsing key-value pairs from ESLint inline comments like eslint-disable-next-line rule: value - applied /\s*([:,])\s*/gu globally to untrimmed input. Without a leading .trim(), strings beginning or ending with large whitespace blocks caused the regex engine to attempt exponential match permutations. The fix (commit 071be842) added .trim() before the replace and introduced a negative lookbehind (?<!\s) to prevent the engine from backtracking through leading whitespace. The package is part of the ESLint flat-config rewrite infrastructure and is consumed by ESLint plugin authors and tools using the new ESLint configuration API. No CPE string was provided in the intelligence data.

Affected ProductsAI

All versions of the npm package @eslint/plugin-kit before 0.2.3 are affected. The vulnerability exists in the ConfigCommentParser.parseStringConfig method within the ESLint rewrite monorepo. No CPE string was provided in the available intelligence. Version 0.2.3 introduces the fix per the upstream commit and Snyk advisory SNYK-JS-ESLINTPLUGINKIT-8340627 at https://security.snyk.io/vuln/SNYK-JS-ESLINTPLUGINKIT-8340627.

RemediationAI

Upgrade @eslint/plugin-kit to version 0.2.3 or later - this is the vendor-released patch confirmed by the upstream fix commit at https://github.com/eslint/rewrite/commit/071be842f0bd58de4863cdf2ab86d60f49912abf and documented in the Snyk advisory at https://security.snyk.io/vuln/SNYK-JS-ESLINTPLUGINKIT-8340627. In package.json or lockfile, pin to >=0.2.3 and run npm audit fix or yarn upgrade @eslint/plugin-kit. If immediate upgrade is blocked, restrict ESLint execution to trusted source files and avoid running ESLint against user-submitted or externally sourced code in automated pipelines; this eliminates the untrusted-input attack surface entirely but may not be feasible in open-source CI or code review tooling. Adding a file-size or comment-string-length guard upstream of ESLint invocation is a possible compensating control but carries risk of breaking legitimate large-comment edge cases.