AIKIDO-2025-10417

TL;DR

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via Polynomial Backtracking in Razor syntax highlighting. The vulnerability stemmed from an inefficient regex pattern used to parse @ directives in Razor code. An attacker could exploit this flaw by injecting a malicious string with excessive consecutive characters, causing catastrophic backtracking that exponentially increases CPU processing time and leads to application hang or denial of service.