Skip to content
OpenAdvisories
Medium · 5.3 CVE-2014-8881 GHSA-mvmf-cvfx-qg55

Regular Expression Denial of Service in bleach

Published Sep 1, 2020 · Updated Nov 8, 2023 · Assigned by GHSA

Description

All versions of the `bleach` package are vulnerable to a regular expression denial of service attack when certain types of input are passed into the sanitize function.

## Recommendation

The `bleach` package is not currently maintained, and has not seen an update since 2014.

To mitigate this issue, it is necessary to use an alternative module that is actively maintained and provides similar functionality. There are [multiple modules fitting this criteria available on npm.](https://www.npmjs.com/search?q=html%20sanitizer&page=1&ranking=optimal).

Affected packages

EcosystemPackageAffectedFixedRecord
npm bleach >= 0.0.0 — GHSA-mvmf-cvfx-qg55

References