CVE-2025-5896 Details
Description
A vulnerability was found in tarojs taro up to 4.1.1. It has been declared as problematic. This vulnerability affects unknown code of the file taro/packages/css-to-react-native/src/index.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely. Upgrading to version 4.1.2 is able to address this issue. The name of the patch is c2e321a8b6fc873427c466c69f41ed0b5e8814bf. It is recommended to upgrade the affected component.
A denial-of-service vulnerability has been identified in tarojs taro versions through 4.1.1. This issue arises from inefficient regular expression processing in the file taro/packages/css-to-react-native/src/index.js, which can be exploited by embedding maliciously crafted code blocks into parsed CSS strings. The vulnerability allows for high CPU usage, application freezing, or a denial-of-service condition. The vulnerability can be exploited remotely.
Users are advised to upgrade to taro version 4.1.2, which addresses this vulnerability by optimizing the regular expressions to prevent improper matching and improve processing efficiency. The patched version can be downloaded from the Taro GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 10, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/NervJS/taro/pull/17619 | CISA-ADP | ExploitIssue TrackingPatch |
| https://github.com/NervJS/taro/commit/c2e321a8b6fc873427c466c69f41ed0b5e8814bf | [email protected] | Patch |
| https://github.com/NervJS/taro/pull/17619 | [email protected] | ExploitIssue TrackingPatch |
| https://github.com/NervJS/taro/releases/tag/v4.1.2 | [email protected] | Release Notes |
| https://vuldb.com/?ctiid.311668 | [email protected] | Permissions RequiredVDB Entry |
| https://vuldb.com/?id.311668 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/?submit.585796 | [email protected] | Third Party AdvisoryVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1333 | Inefficient Regular Expression Complexity | [email protected] |
| CWE-1333 | Inefficient Regular Expression Complexity | [email protected] |
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| taro taro | < 4.1.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2025 | Initial Analysis | [email protected] |
| Jun 10, 2025 | CVE Modified | CISA-ADP |
| Jun 9, 2025 | New CVE Received | [email protected] |