CVE-2022-31103: Improper Check for Unusual or Exceptional Conditions

June 27, 2022 (updated July 6, 2022)

lettersanitizer is a DOM-based HTML email sanitizer for in-browser email rendering. All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule @keyframes. This package is depended on by react-letter, therefore everyone using react-letter is also at risk. The problem has been patched in version 1.0.2.

References

github.com/advisories/GHSA-7r3r-gq8p-v9jj
github.com/mat-sz/lettersanitizer/commit/96d3dfe2ef0465d47324ed4d13e91ba0816a173f
github.com/mat-sz/lettersanitizer/security/advisories/GHSA-7r3r-gq8p-v9jj
github.com/mat-sz/react-letter/issues/17
nvd.nist.gov/vuln/detail/CVE-2022-31103

Code Behaviors & Features

Detect and mitigate CVE-2022-31103 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →