CVE-2022-25887

Katalog CVE

CVSS 7.5 · High EPSS 1,5%

Kerentanan Inefficient Regular Expression Complexity pada apostrophecms sanitize-html. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.

Rincian

Terbit di NVD

30 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1333: Inefficient Regular Expression Complexity

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 72,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/apostrophecms/sanitize-html/commit/b4682c12fd30e12e82fa2d9b766de91d7d2cd23c patch · advisory pihak ketiga
• https://github.com/apostrophecms/sanitize-html/pull/557 issue tracking · patch · advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3008102 patch · advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-2957526 patch · advisory pihak ketiga