Open Mercato
Monthly
Denial-of-service via ReDoS in Open Mercato affects all versions prior to 0.6.4, allowing an authenticated administrator who can create custom-field regex rules to introduce catastrophic backtracking patterns that block the Node.js event loop when a crafted input string is submitted. The vulnerability affects the custom-field validation pipeline across server-side (packages/core, packages/shared) and client-side (packages/ui CrudForm) components, with confirmed exposure at the PUT /api/customers/companies endpoint. No active exploitation is recorded in CISA KEV, but a proof-of-concept was submitted as part of the CERT-PL disclosure and is referenced in the public patch PR.
Denial-of-service via ReDoS in Open Mercato affects all versions prior to 0.6.4, allowing an authenticated administrator who can create custom-field regex rules to introduce catastrophic backtracking patterns that block the Node.js event loop when a crafted input string is submitted. The vulnerability affects the custom-field validation pipeline across server-side (packages/core, packages/shared) and client-side (packages/ui CrudForm) components, with confirmed exposure at the PUT /api/customers/companies endpoint. No active exploitation is recorded in CISA KEV, but a proof-of-concept was submitted as part of the CERT-PL disclosure and is referenced in the public patch PR.