HighGHSA-cgfm-xwp7-2cvrCVE-2022-25887

Sanitize-html Vulnerable To REDoS Attacks

Published 31 Aug 2022 · Updated 22 Apr 2024

Affected package

Affected: <2.7.1
Fixed in: 2.7.1

Update to the fixed version for your release line, for example:npm install sanitize-html@2.7.1

Details

The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.

Is GHSA-cgfm-xwp7-2cvr in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected sanitize-html, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisorynvd.nist.gov/vuln/detail/CVE-2022-25887
Linkgithub.com/apostrophecms/sanitize-html/pull/557
Linkgithub.com/apostrophecms/sanitize-html/commit/b4682c12fd30e12e82fa2d9b766de91d7d2cd23c
Linksecurity.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3008102
Linksecurity.snyk.io/vuln/SNYK-JS-SANITIZEHTML-2957526

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.