CVE-2021-32821

Regular expression Denial of Service in MooTools

MooTools is a collection of JavaScript utilities for JavaScript developers. All known versions include a CSS selector parser that is vulnerable to Regular Expression Denial of Service (ReDoS). An attack requires that an attacker can inject a string into a CSS selector at runtime, which is quite common with e.g. jQuery CSS selectors. No patches are available for this issue.

Affected

mootools · mootools-core

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v3.1 GITHUB

6.2 MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.65% chance of exploitation in the next 30 days, 50th percentile

Published

2023-01-03

Updated

2025-03-10

Proof-of-concept exploits (1)

• https://securitylab.github.com/advisories/GHSL-2020-345-redos-mootools/

Security advisories

• https://securitylab.github.com/advisories/GHSL-2020-345-redos-mootools
• advisories/GHSA-v63q-hgqc-qvpg

References

• CVE Record
• NVD entry