CVE-2022-25887 @ Npm-sanitize-html-2.3.2

[westonphillips]

Vulnerable Package issue exists @ Npm-sanitize-html-2.3.2 in branch main

The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.

Namespace: westonphillips
Repository: CheckmarxOnePOV
Repository Url: https://github.com/westonphillips/CheckmarxOnePOV
CxAST-Project: westonphillips/CheckmarxOnePOV
CxAST platform scan: dfe9066d-c97b-4e43-85c7-29fe7c9fee82
Branch: main
Application: CheckmarxOnePOV
Severity: HIGH
State: NOT_IGNORED
Status: RECURRENT
CWE: CWE-1333

---

Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: NONE
Availability impact: HIGH
Remediation Upgrade Recommendation: 2.7.1

---

References
Advisory
Pull request
Commit
Release Note