~ / search / GHSA-cgfm-xwp7-2cvr

GHSA-cgfm-xwp7-2cvr

Sanitize-html Vulnerable To REDoS Attacks

Source: GitHub Advisory Database (reviewed) High CVE-2022-25887

Packages

EcosystemPackageAffectedFixed in
npm sanitize-html < 2.7.1 2.7.1

Details

As written in the advisory (Markdown source, shown as plain text).

The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.

References

External links from the advisory. They lead to third-party sites.