{"id":"CVE-2026-54461","title":"Habitica is a habit tracker application that treats goals like a role-playing game","summary":"Habitica is a habit tracker application that treats goals like a role-playing game. From 4.172.1 until 5.48.2, a query parameter on Habitica's /api/v3/groups/:groupId/members route is not sanitized before being interpreted as a regular e…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-1333"],"vendor":"HabitRPG","product":"habitica","affected":["habitica >= 4.172.1, < 5.48.2"],"published":"2026-09-24","updated":"2026-09-24","sourceUpdated":"2026-09-24T18:17:13.820","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54461","references":[{"url":"https://github.com/HabitRPG/habitica/commit/7b7dc255dff1564935675399ff168e8a91b8afca","label":"security-advisories@github.com"},{"url":"https://github.com/HabitRPG/habitica/releases/tag/v5.48.2","label":"security-advisories@github.com"},{"url":"https://github.com/HabitRPG/habitica/security/advisories/GHSA-x772-22c9-gq58","label":"security-advisories@github.com"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-24T17:48:30.401Z","epss":0.00295,"epssPercentile":0.19764,"slug":"CVE-2026-54461","body":"## Overview\n\nHabitica is a habit tracker application that treats goals like a role-playing game. From 4.172.1 until 5.48.2, a query parameter on Habitica's /api/v3/groups/:groupId/members route is not sanitized before being interpreted as a regular expression. An authenticated caller can supply a computationally expensive regular expression that degrades application performance or halts Node.js processes. This issue is fixed in version 5.48.2.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}