CVE-2020-28469: 
JavaScript vulnerability analysis and mitigation

CVE-2020-28469 affects the glob-parent package versions before 5.1.2. The vulnerability is related to the enclosure regex used to check for strings ending in enclosure containing path separator (CVE, NVD).

The vulnerability is classified as a Regular Expression Denial of Service (ReDoS) issue. The problem lies in the enclosure regex implementation that checks for strings ending in enclosure containing path separators. A proof of concept exploit demonstrates that sending specially crafted input with multiple path separators can cause excessive CPU consumption (Snyk).

When successfully exploited, this vulnerability can lead to a Denial of Service condition through excessive CPU consumption. The attack can cause the service to work very slowly with processing time exponentially related to input size, potentially making the system inaccessible to legitimate users (Snyk).

The vulnerability has a proof-of-concept exploit available. An attacker can trigger the vulnerability by sending specially crafted input containing multiple path separators. The exploit code demonstrates that using a string with 5000 path separators can cause significant processing delays (Snyk).

The recommended mitigation is to upgrade glob-parent to version 5.1.2 or higher. The fix was implemented in pull request #36 which eliminates the ReDoS vulnerability (GitHub PR, GitHub Release).