-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability lies in the sanitize function in lib/sanitize.js, which is responsible for cleaning user input. This function recursively processes nested objects and arrays. However, it lacks any mechanism to limit the recursion depth. An attacker can exploit this by sending a request with a deeply nested JSON body. When the middleware in index.js passes this malicious input to the prepareSanitize function, which in turn calls sanitize, the uncontrolled recursion leads to a stack overflow, causing the application to crash. This results in a Denial of Service (DoS) vulnerability. The provided gist and the source code of lib/sanitize.js clearly show the recursive nature of the sanitize function without any safeguards.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| express-xss-sanitizer | npm | <= 2.0.0 |
JavaScriptJavaScriptOngoing coverage of React2Shell