---
id: GHSA-jgvr-6x5w-hx5w
title: 'Zoo Design Studio: Recursive KCL parsing is vulnerable to denial-of-service'
summary: 'Zoo Design Studio: Recursive KCL parsing is vulnerable to denial-of-service'
severity: medium
cwe:
  - CWE-770
vendor: zoo-kcl
product: zoo-kcl
ecosystem: pip
affected:
  - zoo-kcl < 0.3.129
  - kcl-lib < 0.2.129
patched:
  - zoo-kcl 0.3.129
  - kcl-lib 0.3.129
published: '2026-08-20'
updated: '2026-08-20'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-jgvr-6x5w-hx5w'
references:
  - url: >-
      https://github.com/KittyCAD/modeling-app/security/advisories/GHSA-jgvr-6x5w-hx5w
  - url: 'https://github.com/advisories/GHSA-jgvr-6x5w-hx5w'
tags:
  - ghsa
  - pip
ingestedAt: '2026-08-20T18:59:55.366Z'
---

## Overview

### Impact
Feeding a KCL program that wraps an expression in deep, unnecessary parentheses triggers the parser’s recursive `expression` -> `unnecessarily_bracketed` -> `expression` path. With enough nesting, the call stack grows until it exceeds the process stack limit, causing a stack overflow.

## Affected packages

- `zoo-kcl < 0.3.129`
- `kcl-lib < 0.2.129`

## Remediation

Upgrade to a patched release:

- `zoo-kcl 0.3.129`
- `kcl-lib 0.3.129`