Attack Chain

1. An attacker crafts a text string containing a large number of repeated, identical punctuation characters such as (, [, {, #, @, !, %, ^, ~, <, or >.
2. The attacker submits the crafted text string to an application that uses the @chenglou/pretext library. The text could be sent as a message in a chat application, submitted in a comment form, or used in server-side rendering.
3. The application's code calls the prepare() function from the @chenglou/pretext library to perform layout measurement on the attacker-controlled text. This happens in layout.ts at line 472.
4. The prepare() function internally calls prepareInternal() in layout.ts (line 424), which then invokes analyzeText() at line 430.
5. analyzeText() calls the buildMergedSegmentation() function (analysis.ts:1013 -> analysis.ts:795) to process the text. This function uses Intl.Segmenter to break the text into segments.
6. For each segment identified by Intl.Segmenter, the buildMergedSegmentation() function iterates through the segments, checking if consecutive non-word-like segments consist of the same single character. When it finds matching segments, it merges them.
7. During the merge process, the isRepeatedSingleCharRun() function is called (analysis.ts:857 -> analysis.ts:285) to verify that all characters in the accumulated segment match the character being merged.
8. The isRepeatedSingleCharRun() function iterates over the entire accumulated string (O(n) operation) for each merge, resulting in O(n²) complexity for large inputs. This causes the main thread to block. The final objective is to cause denial of service on the client or server processing the text.

Impact

This vulnerability allows an attacker to cause a denial-of-service (DoS) condition. Specifically, chat/messaging applications, comment/form systems, or server-side rendering processes that use @chenglou/pretext can be targeted. A single crafted message or input (e.g., 80KB of repeated parenthesis characters) can block the main thread for approximately 20 seconds. In server-side rendering scenarios (Node.js/Bun), a single malicious request can consume excessive CPU time (20+ seconds per 80KB of payload). This can lead to a complete outage of the affected service.

Recommendation

• Limit the length of text passed to the prepare() function to mitigate the impact of this vulnerability before a patch is available.
• Monitor CPU usage for processes utilizing the @chenglou/pretext library for unusually long execution times that could indicate exploitation of this vulnerability.
• Deploy the Sigma rule that detects potential exploitation attempts based on excessive process execution time.
• Upgrade to a patched version of @chenglou/pretext once it becomes available.