Published: 30/08/2022 Updated: 08/08/2023

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 0

The package sanitize-html prior to 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apostrophecms sanitize-html

Debian Bug report logs - #1019219 node-sanitize-html: CVE-2022-25887 Package: src:node-sanitize-html; Maintainer for src:node-sanitize-html is Debian Javascript Maintainers <pkg-javascript-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, 5 Sep 2022 19:57:02 UTC Severit ...

Synopsis Moderate: Red Hat Advanced Cluster Management 262 security update and bug fixes Type/Severity Security Advisory: Moderate Topic Red Hat Advanced Cluster Management for Kubernetes 262 GeneralAvailability release images, which fix bugs and update container imagesRed Hat Product Security has rated this update as having a security i ...

The package sanitize-html before 271 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal ...

CWE-1333 https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-2957526 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3008102 https://github.com/apostrophecms/sanitize-html/pull/557 https://github.com/apostrophecms/sanitize-html/commit/b4682c12fd30e12e82fa2d9b766de91d7d2cd23c https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1019219 https://nvd.nist.gov

CVE-2022-25887

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect