GHSA-jgvr-6x5w-hx5w

Zoo Design Studio: Recursive KCL parsing is vulnerable to denial-of-service

Published

2026-08-20

Modified

2026-08-20

Sources

github-advisory

Summary

### Impact Feeding a KCL program that wraps an expression in deep, unnecessary parentheses triggers the parser’s recursive `expression` -> `unnecessarily_bracketed` -> `expression` path. With enough nesting, the call stack grows until it exceeds the process stack limit, causing a stack overflow.

Affected packages

Remediation: Upgrade to 0.3.129 or later.

References

• https://github.com/advisories/GHSA-jgvr-6x5w-hx5w