-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability was specifically patched by replacing a regex-based comment removal approach with manual string operations in index.js. The commit diff shows the vulnerable regex pattern was used in href sanitization within the main sanitizeHtml() function. The CWE-1333 classification and advisory descriptions confirm this was a regex efficiency issue in comment handling, making the sanitizeHtml() function's comment removal logic the clear vulnerable point.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| sanitize-html | npm | < 2.7.1 | 2.7.1 |