CVE-2022-25887

Regular Expression Denial of Service (ReDoS)

State: Published
Severity: 5.3 Medium
Published: Aug 30, 2022
Updated: Sep 17, 2024
Reserved: Feb 24, 2022

Description

The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	snyk

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
sanitize-htmln/a	before 2.7.1Affected

References

https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-2957526
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3008102
https://github.com/apostrophecms/sanitize-html/pull/557
https://github.com/apostrophecms/sanitize-html/commit/b4682c12fd30e12e82fa2d9b766de91d7d2cd23c

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.