Improper handling of CSS at-rules in lettersanitizer

Description

All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule @keyframes.

This package is depended on by react-letter, therefore everyone using react-letter is also at risk.

Recommendation

Update the lettersanitizer package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.0.2
• Patched version(s): 1.0.2

References

• GHSA-7r3r-gq8p-v9jj
• CVE-2022-31103
• CWE-754
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Improper handling of multiline messages in node-irc affects matrix-appservice-irc - CVE-2022-29166
• materialize-css vulnerable to cross-site Scripting (XSS) due to improper escape of user input - CVE-2022-25349
• Improper Removal of Sensitive Information Before Storage or Transfer in Strapi - CVE-2022-30618
• Improper beacon events in matrix-js-sdk can result in availability issues - CVE-2022-39236

Tags:

npm

lettersanitizer