GHSA-w455-mfq9-hf74

insane vulnerable to Regular Expression Denial of Service

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-26303

Packages

Ecosystem	Package	Affected	Fixed in
npm	insane	<= 2.6.2	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

insane is a whitelist-oriented HTML sanitizer. Versions 2.6.2 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches are available.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-26303 advisory
https://github.com/bevacqua/insane/issues/19 web
https://github.com/bevacqua/insane package
https://securitylab.github.com/advisories/GHSL-2020-289-redos-insane advisory