Regular expression denial of service (ReDoS) in sanitize-html
Priority LOW 36CWE-1333Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 7 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.
Summary
The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.
Why it matters now
EPSS 0.01551 75th percentileScored 2026-11-07
Fix Partial sanitize-html: 2.7.1sanitize-html (npm): 2.7.1Red Hat: 1 advisoryRed Hat: 7 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | sanitize-html | before 2.7.1 | 2.7.1 | Patch available | CNA |
| — | sanitize-html (npm) | before 2.7.1 | 2.7.1 | Patch available | GHSA-cgfm-xwp7-2cvr |
- sanitize-html Vendor— Affected before 2.7.1 Fixed in 2.7.1 Patch available CNA
- sanitize-html (npm) Vendor— Affected before 2.7.1 Fixed in 2.7.1 Patch available GHSA-cgfm-xwp7-2cvr
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apostrophecms:sanitize-html:*:*:*:*:*:node.js:*:* | before 2.7.1 | Vulnerable | apostrophecms |
- cpe:2.3:a:apostrophecms:sanitize-html:*:*:*:*:*:node.js:*:* Versions before 2.7.1 Vulnerable ·apostrophecms
Remediation
- Fix · CNA sanitize-html Fixed in 2.7.1
- Fix · GHSA-cgfm-xwp7-2cvr sanitize-html (npm) Fixed in 2.7.1 Advisory →
Red Hat 1 advisory
- RHSA-2022:7313 Released 2022-11-02 · Red Hat rating ModerateRed Hat Advanced Cluster Management 2.6.2 security update and bug fixes
- Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 rhacm2/acm-governance-policy-addon-controller-rhel8, rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8 +45
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Service Mesh 2.0 | Affected | No fix yet |
| OpenShift Service Mesh 2.1 | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
Timeline
- 2026-10-02 Threatist record created from CVE-2022-25887
- 2026-10-03 Alias added: GHSA-cgfm-xwp7-2cvr
References
More apostrophecms Sanitize-html vulnerabilities
- TI-2024-14258 Information disclosure in sanitize-html CVSS 3.1MEDIUM 5.3
- TI-2026-29000 ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements CVSS 3.1MEDIUM 6.1
- TI-2019-15279 Cross-site scripting in sanitize-html CVSS 3.1MEDIUM 6.1
- TI-2014-08427 Cross-site scripting in sanitize-html CVSS 3.1MEDIUM 6.1
- TI-2016-09355 sanitize-html before 1.4.3 has XSS. CVSS 3.1MEDIUM 6.1
- TI-2021-08273 Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the… CVSS 3.1MEDIUM 5.3
Sources
- CVE-2022-25887 · CVE Program
- CVE-2022-25887 · NVD
- FIRST EPSS
- GHSA-cgfm-xwp7-2cvr · GitHub Advisory Database · CC BY 4.0
- CVE-2022-25887 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences