CVE-2022-31103: lettersanitizer project lettersanitizer

csirt@kutim:~/threat-intel/cve/CVE-2022-31103

CVSS 7.5 · High EPSS 1,5%

Kerentanan Improper Check for Unusual or Exceptional Conditions pada lettersanitizer project lettersanitizer. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

lettersanitizer is a DOM-based HTML email sanitizer for in-browser email rendering. All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule `@keyframes`. This package is depended on by [react-letter](https://github.com/mat-sz/react-letter), therefore everyone using react-letter is also at risk. The problem has been patched in version 1.0.2.

Rincian

Terbit di NVD: 27 Juni 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-754: Improper Check for Unusual or Exceptional Conditions
EPSS (30 hari): 1,5% peluang dieksploitasi; lebih tinggi dari 73,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
lettersanitizer project	lettersanitizer	Semua versi sebelum 1.0.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/mat-sz/lettersanitizer/commit/96d3dfe2ef0465d47324ed4d13e91ba0816a173f patch · advisory pihak ketiga
https://github.com/mat-sz/lettersanitizer/security/advisories/GHSA-7r3r-gq8p-v9jj advisory pihak ketiga
https://github.com/mat-sz/react-letter/issues/17 issue tracking · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.