ReDoS Vulnerability in gaizhenbiao/chuanhuchatgpt

CVE-2024-6038

What is CVE-2024-6038?

A vulnerability exists in the latest version of gaizhenbiao/chuanhuchatgpt, specifically within the filter_history function located in the utils.py module. This vulnerability is categorized as a Regular Expression Denial of Service (ReDoS). The function processes a user-specified keyword and performs a regular expression match against chat history filenames. The flaw arises from improper sanitization or validation of the keyword parameter, which allows an attacker to introduce a specially crafted regular expression. This can lead to a denial of service condition, significantly degrading system performance and potentially resulting in service unavailability.

References