Technical impact
A YAML alias bomb exploit occurs when malicious frontmatter in a HedgeDoc note causes the js‑yaml library to expand a large number of anchor aliases, consuming excessive CPU core time and blocking the single Node.js event loop. This denial‑of‑service condition can keep the publish endpoint (/s/<shortid>) and the editor view (/noteId) unresponsive for approximately 235 seconds per request, allowing concurrent requests to hang or drop and rendering the instance unavailable. The weakness is rooted in uncontrolled resource consumption (CWE‑400) and potential resource exhaustion (CWE‑409).
Affected Systems
Any instance of HedgeDoc running a version earlier than 1.11.0 is vulnerable. The affected product is HedgeDoc, maintained by Hedgedoc. Users of pre‑1.11.0 releases should verify the version and consider upgrade before patching.
Risk and Exploitability
The CVSS score of 8.3 indicates a high‑severity denial‑of‑service vulnerability. The EPSS score of <1 % indicates a very low probability of exploitation, and the fact that the vulnerability is not listed in the CISA KEV catalog suggests that exploit evidence is limited at the time of analysis. Based on the description, it is inferred that an attacker could trigger the DoS by creating or accessing a note with malicious frontmatter on any publicly accessible instance. The likely attack vector is normal HTTP requests to the publish or editor endpoints. An attacker can cause the event loop to be saturated, leading to concurrent requests hanging or dropping and rendering the instance unavailable. The impact persists across service restarts until the offending note is deleted.
