kubeflow-pipelines
2.2.0-r9
7.5
CVSS V3
fast-xml-parser vulnerable to ReDOS at currency parsing
A ReDOS that exists on currency.js was discovered by Gauss Security Labs R&D team.
https://github.com/NaturalIntelligence/fast-xml-parser/blob/v4.4.0/src/v5/valueParsers/currency.js#L10 contains a vulnerable regex
pass the following string '\t'.repeat(13337) + '.'
Denial of service during currency parsing in experimental version 5 of fast-xml-parser-library
