🔒 Security: Vulnerability Detected in Dependency (NPM debug)

[kat2codes]

Prerequisites

• [x] Checked that your issue hasn't already been filed by cross-referencing issues with the faq label
• [x] Checked next-gen ES issues and syntax problems by using the same environment and/or transpiler configuration without Mocha to ensure it isn't just a feature that actually isn't supported in the environment in question or a bug in your code.
• [x] 'Smoke tested' the code to be tested by running it outside the real test suite to get a better sense of whether the problem is in the code under test, your usage of Mocha, or Mocha itself
• [x] Ensured that there is no discrepancy between the locally and globally installed versions of Mocha. You can find them with: node_modules/.bin/mocha --version(Local) and mocha --version(Global). We recommend that you not install Mocha globally.

Description

I would like to report a high vulnerability that has been detected in one of the dependencies of Mocha. The vulnerability is present in the debug package, specifically version 4.3.4. The vulnerability is classified as CWE-1333: Inefficient Regular Expression Complexity.

Package: debug Version: 4.3.4 (latest) CWE: CWE-1333 (Inefficient Regular Expression Complexity) Description: In NPM debug, the enable function accepts a regular expression from user input without escaping it. Arbitrary regular expressions could be injected to cause a Denial of Service attack on the user's browser, otherwise known as a ReDoS (Regular Expression Denial of Service). This is a different issue than CVE-2017-16137.

Please note that I did not directly install or utilize debug package. Instead, it is a dependency of the Mocha package I am currently using, specifically version 10.2.0.

I kindly request the necessary actions to be taken to address and remediate this vulnerability to ensure the security and stability of the mocha framework. If any further info is required, please let me know.

Thanks!

Additional Information

[JoshuaKGoldberg]

See https://github.com/debug-js/debug/issues/924#issuecomment-1539047726. Thanks for filing, but this isn't a good use of anybody's time to investigate.