Habitica: Regex Injection / ReDoS in Member Search
Priority LOW 29CWE-1333Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-1333.
Summary
Habitica is a habit tracker application that treats goals like a role-playing game. From 4.172.1 until 5.48.2, a query parameter on Habitica's /api/v3/groups/:groupId/members route is not sanitized before being interpreted as a regular expression. An authenticated caller can supply a computationally expensive regular expression that degrades application performance or halts Node.js processes. This issue is fixed in version 5.48.2.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00295 22nd percentileScored 2026-11-07
Fix Fixed habitica (HabitRPG): 5.48.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA habitica (HabitRPG) Fixed in 5.48.2
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54461
References
More HabitRPG vulnerabilities
- TI-2024-35735 GHSL-2024-110: Reflected XSS in /register in habitica CVSS 4.0MEDIUM 5.0
- TI-2024-35734 GHSL-2024-109: Reflected XSS in /login in habitica CVSS 4.0MEDIUM 5.0
- TI-2024-35736 GHSL-2024-111: Reflected XSS in /home in habitica CVSS 4.0LOW 2.0
- TI-2022-07246 Habitica - DOM XSS in login page CVSS 3.1MEDIUM 6.1
- TI-2022-07247 Habitica - Open redirect in login page CVSS 2.0MEDIUM 5.8
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences