Sanitize-html Vulnerable To REDoS Attacks

ALTO 7.5CVE-2022-25887 · GHSA-cgfm-xwp7-2cvr · Published 30/08/2022 · updated 17/06/2026

In breve

CVE-2022-25887 è una vulnerabilità ALTO (CVSS 7.5) che riguarda sanitize-html (apostrophecms), sanitize-html.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.6%, superiore al 75.1% delle vulnerabilità.
Correzione: aggiornare a 2.7.1 o successiva.

Package	Affected versions	Patched versions
sanitize-html apostrophecms	`< 2.7.1`	`2.7.1`
sanitize-html npm	`< 2.7.1`	`2.7.1`

Description

The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.

NVD description

The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.

References

nvd.nist.gov/vuln/detail/CVE-2022-25887 · ADVISORY
apostrophecms/sanitize-html#557 · WEB
apostrophecms/sanitize-html commit b4682c1 · WEB
security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3008102 · WEB
security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-2957526 · WEB

Altre vulnerabilità di sanitize-html

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

sanitize-html

apostrophecms

< 2.7.1

2.7.1

sanitize-html

npm

< 2.7.1

2.7.1

Description

The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.

NVD description

The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.

Altre vulnerabilità di sanitize-html

Vedi tutto →