PT-2022-17586 · Unknown+2 · Sanitize-Html+2

Nariyoshi Chida · Published 2022-08-30 · Updated 2025-12-23 · CVE-2022-25887

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions sanitize-html versions prior to 2.7.1

Description The issue is related to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.

Recommendations For versions prior to 2.7.1, update to version 2.7.1 or later to resolve the issue.

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2022-25887

GHSA-CGFM-XWP7-2CVR

USN-7464-1

Affected Products

Linuxmint

Ubuntu

Sanitize-Html

References · 16

• https://github.com/apostrophecms/sanitize-html/commit/b4682c12fd30e12e82fa2d9b766de91d7d2cd23c · Patch
• https://github.com/apostrophecms/sanitize-html/pull/557 · Patch
• https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-2957526 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-25887 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-25887 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2022-25887 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-25887 · Security Note
• https://osv.dev/vulnerability/GHSA-cgfm-xwp7-2cvr · Vendor Advisory
• https://osv.dev/vulnerability/USN-7464-1 · Vendor Advisory
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3008102 · Patch
• https://osv.dev/vulnerability/CVE-2022-25887 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-25887 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-25887 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25887 · Security Note
• https://ubuntu.com/security/notices/USN-7464-1 · Vendor Advisory