Advisory details:
github_osv / GHSA-mvmf-cvfx-qg55
| Advisory ID | github_osv/GHSA-mvmf-cvfx-qg55 |
| Aliases |
CVE-2014-8881
|
| Summary | Regular Expression Denial of Service in bleach All versions of the `bleach` package are vulnerable to a regular expression denial of service attack when certain types of input are passed into the sanitize function. ## Recommendation The `bleach` package is not currently maintained, and has not seen an update since 2014. To mitigate this issue, it is necessary to use an alternative module that is actively maintained and provides similar functionality. There are [multiple modules fitting this criteria available on npm.](https://www.npmjs.com/search?q=html%20sanitizer&page=1&ranking=optimal). |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 4.8 |
| Risk | 2.4 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| There are no known CWE. |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 5.3 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-mvmf-cvfx-qg55/GHSA-mvmf-cvfx-qg55.json |
| generic_textual | MODERATE |
| Reference id | Reference type | URL |
|---|---|---|
| https://nvd.nist.gov/vuln/detail/CVE-2014-8881 | ||
| https://snyk.io/vuln/npm:bleach:20151024 | ||
| https://www.npmjs.com/advisories/47 |
No exploits are available.
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
There are no SSVC decisions available.