ESLint Stack Overflow Vulnerability in RuleTester Serialization Handling

A stack overflow vulnerability exists in ESLint versions prior to 9.26.0. The issue arises in the serialization module when objects with circular references are processed. This vulnerability can be exploited through the RuleTester.run() method, which is used to validate test cases and check for duplicates. During this process, the isSerializable() function is called to perform serialization checks. If an object with a circular reference is introduced, isSerializable() enters an infinite loop of recursion, leading to a stack overflow.

Impact

Exploitation of this vulnerability causes a process crash due to a stack overflow. However, in certain runtime environments, this could potentially be leveraged for code execution.

Reproduction

The vulnerability can be reproduced by passing an object with a circular reference into the RuleTester.run() method. This will trigger the stack overflow by causing the isSerializable() function to recurse indefinitely without detecting the cycle.

Remediation

Users can update to ESLint version 9.26.0 or later, where this vulnerability has been fixed.