Improper handling of CSS at-rules in lettersanitizer

HOCH 7.5CVE-2022-31103 · GHSA-7r3r-gq8p-v9jj · Published 27/06/2022 · updated 17/06/2026

Kurz gesagt

CVE-2022-31103 ist eine Schwachstelle (HOCH (CVSS 7.5)) in lettersanitizer (lettersanitizer project), lettersanitizer.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.5%, höher als bei 74.8% aller Schwachstellen.
Abhilfe: auf 1.0.2 oder neuer aktualisieren.

Package	Affected versions	Patched versions
lettersanitizer lettersanitizer_project	`< 1.0.2`	`1.0.2`
lettersanitizer npm	`< 1.0.2`	`1.0.2`

Description

Impact

All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule @keyframes.

This package is depended on by react-letter, therefore everyone using react-letter is also at risk.

Patches

The problem has been patched in version 1.0.2.

Workarounds

There is no workaround besides upgrading.

References

The issue was originally reported in the react-letter repository: https://github.com/mat-sz/react-letter/issues/17

For more information

If you have any questions or comments about this advisory:

Open an issue in lettersanitizer
Email me at [email protected]

NVD description

lettersanitizer is a DOM-based HTML email sanitizer for in-browser email rendering. All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule `@keyframes`. This package is depended on by [react-letter](https://github.com/mat-sz/react-letter), therefore everyone using react-letter is also at risk. The problem has been patched in version 1.0.2.

References

mat-sz/lettersanitizer security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2022-31103 · ADVISORY
mat-sz/react-letter · WEB
mat-sz/lettersanitizer commit 96d3dfe · WEB
mat-sz/lettersanitizer · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

lettersanitizer

lettersanitizer_project

< 1.0.2

1.0.2

lettersanitizer

npm

< 1.0.2

1.0.2

Description

Impact

All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule @keyframes.

This package is depended on by react-letter, therefore everyone using react-letter is also at risk.

Patches

The problem has been patched in version 1.0.2.

Workarounds

There is no workaround besides upgrading.

References

The issue was originally reported in the react-letter repository: https://github.com/mat-sz/react-letter/issues/17

For more information

If you have any questions or comments about this advisory:

Open an issue in lettersanitizer
Email me at [email protected]

NVD description