Skip to content

Improper handling of CSS at-rules in lettersanitizer

High
mat-sz published GHSA-7r3r-gq8p-v9jj Jun 22, 2022

Package

npm lettersanitizer (npm)

Affected versions

< 1.0.2

Patched versions

1.0.2

Description

Impact

All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule @keyframes.

This package is depended on by react-letter, therefore everyone using react-letter is also at risk.

Patches

The problem has been patched in version 1.0.2.

Workarounds

There is no workaround besides upgrading.

References

The issue was originally reported in the react-letter repository: mat-sz/react-letter#17

For more information

If you have any questions or comments about this advisory:

Severity

High

CVE ID

CVE-2022-31103

Weaknesses

Improper Neutralization

The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component. Learn more on MITRE.

Loop with Unreachable Exit Condition ('Infinite Loop')

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. Learn more on MITRE.