GHSA-c2c7-rcm5-vvqj found in npm/picomatch@4.0.3

## GHSA-c2c7-rcm5-vvqj found in npm/picomatch@4.0.3 
> [!important] 
> **Risk**: `3.46 (Low)`
> **CVSS**: `7.5` 
### Description
### Impact
`picomatch` is vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*()`, especially when combined with overlapping alternatives or nested extglobs, are compiled into regular expressions that can exhibit catastrophic backtracking on non-matching input.

Examples of problematic patterns include `+(a|aa)`, `+(*|?)`, `+(+(a))`, `*(+(a))`, and `+(+(+(a)))`. In local reproduction, these patterns caused multi-second event-loop blocking with relatively short inputs. For example, `+(a|aa)` compiled to `^(?:(?=.)(?:a|aa)+)$` and took about 2 seconds to reject a 41-character non-matching input, while nested patterns such as `+(+(a))` and `*(+(a))` took around 29 seconds to reject a 33-character input on a modern M1 MacBook.

Applications are impacted when they allow untrusted users to supply glob patterns that are passed to `picomatch` for compilation or matching. In those cases, an attacker can cause excessive CPU consumption and block the Node.js event loop, resulting in a denial of service. Applications that only use trusted, developer-controlled glob patterns are much less likely to be exposed in a security-relevant way.

### Patches
This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2.

Users should upgrade to one of these versions or later, depending on their supported release line.

### Workarounds
If upgrading is not immediately possible, avoid passing untrusted glob patterns to `picomatch`.

Possible mitigations include:
- disable extglob support for untrusted patterns by using `noextglob: true`
- reject or sanitize patterns containing nested extglobs or extglob quantifiers such as `+()` and `*()`
- enforce strict allowlists for accepted pattern syntax
- run matching in an isolated worker or separate process with time and resource limits
- apply application-level request throttling and input validation for any endpoint that accepts glob patterns

### Resources
- Picomatch repository: https://github.com/micromatch/picomatch
- `lib/parse.js` and `lib/constants.js` are involved in generating the vulnerable regex forms
- Comparable ReDoS precedent: CVE-2024-4067 (`micromatch`)
- Comparable generated-regex precedent: CVE-2024-45296 (`path-to-regexp`)
### Affected component 
The vulnerability is in `pkg:npm/picomatch@4.0.3`, found in artifacts `pkg:oci/devguard-documentation?repository_url=ghcr.io/l3montree-dev/devguard-documentation&arch=amd64&tag=main-amd64`, `pkg:oci/l3montree-cybersecurity/devguard/devguard-documentation`.
### Recommended fix
Upgrade to version 4.0.4 or later.
```
# Update all vulnerable npm packages
npm audit fix
# Update only this package
npm install picomatch@4.0.4 
```
### Additional guidance for mitigating vulnerabilities
Visit our guides on [devguard.org](https://devguard.org/risk-mitigation-guides/software-composition-analysis)

<details>

<summary>See more details...</summary>

### Path to component
```mermaid 
 %%{init: { 'theme':'base', 'themeVariables': {
'primaryColor': '#F3F3F3',
'primaryTextColor': '#0D1117',
'primaryBorderColor': '#999999',
'lineColor': '#999999',
'secondaryColor': '#ffffff',
'tertiaryColor': '#ffffff'
} }}%%
 flowchart TD
Your_application(["Your application"]) --- pkg_npm_picomatch_4_0_3(["pkg:npm/picomatch\@4.0.3"])

classDef default stroke-width:2px
```
| Risk Factor | Value | Description | 
| ---- | ----- | ----------- | 
| Vulnerability Depth | `1` | The vulnerability is in a direct dependency of your project. | 
| EPSS | `0.41 %` | The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days. | 
| EXPLOIT | `Not available` | We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database. There are no script kiddies exploiting this vulnerability. | 
| CVSS-BE | `7.5` | - Exploiting this vulnerability significantly impacts availability. | 
| CVSS-B | `7.5` | - The vulnerability can be exploited over the network without needing physical access. - It is easy for an attacker to exploit this vulnerability. - An attacker does not need any special privileges or access rights. - No user interaction is needed for the attacker to exploit this vulnerability. - The impact is confined to the system where the vulnerability exists. - There is a high impact on the availability of the system. | 

More details can be found in [DevGuard](https://main.devguard.org/l3montree-cybersecurity/projects/devguard/assets/devguard-documentation/refs/main/dependency-risks/088aafcc-6c55-2ce5-c7c8-6f1126f484a3)

</details>


--- 
### Interact with this vulnerability
You can use the following slash commands to interact with this vulnerability:

#### 👍 Reply with this to acknowledge and accept the identified risk.
```text
/accept I accept the risk of this vulnerability, because ...
```

#### ⚠️ Mark the risk as false positive: Use one of these commands if you believe the reported vulnerability is not actually a valid issue.
```text
/component-not-present The vulnerable component is not included in the artifact.
```
```text
/vulnerable-code-not-present The component is present, but the vulnerable code is not included or compiled.
```
```text
/vulnerable-code-not-in-execute-path The vulnerable code exists, but is never executed at runtime.
```
```text
/vulnerable-code-cannot-be-controlled-by-adversary Built-in protections prevent exploitation of this vulnerability.
```
```text
/inline-mitigations-already-exist The vulnerable code cannot be controlled or influenced by an attacker.
```

#### 🔁 Reopen the risk: Use this command to reopen a previously closed or accepted vulnerability.
```text
/reopen ... 
```

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

GHSA-c2c7-rcm5-vvqj found in npm/picomatch@4.0.3 #154