{"schema":"threatline.record/2","record":{"id":"CVE-2026-54461","aliases":["GHSA-x772-22c9-gq58"],"summary":"Habitica: Regex Injection / ReDoS in Member Search","details":"Habitica is a habit tracker application that treats goals like a role-playing game. From 4.172.1 until 5.48.2, a query parameter on Habitica's /api/v3/groups/:groupId/members route is not sanitized before being interpreted as a regular expression. An authenticated caller can supply a computationally expensive regular expression that degrades application performance or halts Node.js processes. This issue is fixed in version 5.48.2.","categories":["Unclassified"],"product":"habitica","vendor":"HabitRPG","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-54461","source_modified_at":"2026-09-28T14:57:19.854Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"habitica","vendor":"HabitRPG","versions":[{"status":"affected","version":">= 4.172.1, < 5.48.2"}],"defaultStatus":null},{"source":"GitHub Advisory Database","source_url":"https://github.com/HabitRPG/habitica/security/advisories/GHSA-x772-22c9-gq58","source_modified_at":"2026-07-24T16:38:26Z","fetched_at":"2026-10-24T00:31:04.721601Z","package":{"ecosystem":"","name":"habitica"},"range":"v4.172.1 - v5.48.1"}],"fixed_versions":[],"cvss":6.5,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00295,"percentile":0.21028,"score_date":"2026-10-23"},"published_at":"2026-09-24T17:37:59.280Z","modified_at":"2026-09-28T14:57:19.854Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-54461","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-09-28T14:57:19.854Z"},{"source":"GitHub Advisory Database","url":"https://github.com/HabitRPG/habitica/security/advisories/GHSA-x772-22c9-gq58","fetched_at":"2026-10-24T00:31:04.721601Z","source_modified_at":"2026-07-24T16:38:26Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-54461","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","GitHub Advisory Database","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/HabitRPG/habitica/security/advisories/GHSA-x772-22c9-gq58","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/HabitRPG/habitica/commit/7b7dc255dff1564935675399ff168e8a91b8afca","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/HabitRPG/habitica/releases/tag/v5.48.2","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-09-28T14:57:09.073378Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-28T14:57:19.854Z","content_hash":"57f7f1bba565b52095d0dead2d0f08b6753b69d535a06b16d5e33ec953ede5e6"}}