{"uuid": "266a6cc9-4d9a-4ad7-9b10-cb1eb5c479c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-8492", "type": "seen", "source": "https://t.me/hacking_Attack/17172", "content": "regexploit-py \"my-project/**/*.py\" --glob  \nJavascript / Typescript\n  This will use the bundled NodeJS package in regexploit/bin/javascript which parses your JavaScript as an AST with eslint (https://github.com/typescript-eslint/typescript-eslint/tree/master/packages/parser) and prints out all regexes.  Those regexes are fed into the python ReDoS finder.  regexploit-js my-module/my-file.js another/file.js some/folder/\nregexploit-js \"my-project/node_modules/**/*.js\" --glob  N.B. there are differences between javascript and python regex parsing so there may be some errors. I'm not sure I want (https://hackernoon.com/the-madness-of-parsing-real-world-javascript-regexps-d9ee336df983) to write a JS regex AST!  \nPython imports\n  Search for regexes in all the python modules currently installed in your path / env. This means you can pip install whatever modules you are interested in and they will be analysed. Cpython code is included.  regexploit-python-env  N.B. this doesn't parse the python code to an AST and will only find regexes compiled automatically on module import. Modules are actually imported, so code in the modules will be executed. This is helpful for finding regexes which are built up from smaller strings on load e.g. CVE-2021-25292 in Pillow (https://github.com/python-pillow/Pillow/commit/3bce145966374dd39ce58a6fc0083f8d1890719c)  \nJSON / YAML\n  Yaml support requires pyyaml, which can be installed with pip install regexploit[yaml].  regexploit-json *.json\nregexploit-yaml *.yaml  \nC# (.NET)\n  regexploit-csharp something.cs  \nBugs reported    CVE-2020-5243: uap-core (https://github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9p) affecting uap-python, uap-ruby (https://github.com/ua-parser/uap-ruby/security/advisories/GHSA-pcqq-5962-hvcw), etc. (User-Agent header parsing)  CVE-2020-8492: cpython's urllib.request (https://github.com/python/cpython/commit/0b297d4ff1c0e4480ad33acae793fbaf4bf015b4) (WWW-Authenticate header parsing)  CVE-2021-21236: CairoSVG (https://github.com/advisories/GHSA-hq37-853p-g5cf) (SVG parsing)  CVE-2021-21240: httplib2 (https://github.com/httplib2/httplib2/security/advisories/GHSA-93xj-8mrv-444m) (WWW-Authenticate header parsing)  CVE-2021-25292: python-pillow (https://github.com/python-pillow/Pillow/commit/3bce145966374dd39ce58a6fc0083f8d1890719c) (PDF parsing)  CVE-2021-26813: python-markdown2 (https://github.com/trentm/python-markdown2/pull/387) (Markdown parsing)  CVE-2021-27290: npm/ssri (https://doyensec.com/resources/Doyensec_Advisory_ssri_redos.pdf) (SRI parsing)  CVE-2021-27291: pygments (https://github.com/pygments/pygments/commit/2e7e8c4a7b318f4032493773732754e418279a14) lexers for ADL, CADL, Ceylon, Evoque, Factor, Logos, Matlab, Octave, ODIN, Scilab & Varnish VCL (Syntax highlighting)  CVE-2021-27292: ua-parser-js (https://github.com/faisalman/ua-parser-js/commit/809439e20e273ce0d25c1d04e111dcf6011eb566) (User-Agent header parsing)  CVE-2021-27293: RestSharp (https://github.com/restsharp/RestSharp/issues/1556) (JSON deserialisation in a .NET C# package)  bpo-38804: cpython's http.cookiejar (https://github.com/python/cpython/pull/17157) (Set-Cookie header parsing)  SimpleCrawler (archived) (https://doyensec.com/resources/Doyensec_Advisory_simplecrawler_redos.pdf) (HTML parsing)  CVE-2021-28092: is-svg (https://github.com/sindresorhus/is-svg/commit/01f8a087fab8a69c3ac9085fbb16035907ab6a5b) (SVG parsing)  nuget.org, NuGetGallery (https://github.com/NuGet/NuGetGallery/commit/25d2d3b32b2d9f0b1ca6e0a105b0210c2c4820f4) and NuGet.Client (https://github.com/NuGet/NuGet.Client/commit/a0671e946ce71dc59def5cc8a67c6457d66f33bf) (Parsing NuGet package IDs)  markdown (python) (https://github.com/Python-Markdown/markdown/pull/1130) (Markdown parsing)  ansi-html (nodejs) (https://github.com/Tjatse/ansi-html/issues/19) (ANSI parsing)  Plus unpublished bugs in a handful of pypi, npm, ruby and nuget packages    \nCredits\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:06.030877Z"}