Is CVE-2014-8881 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2014-8881 being exploited in the wild.

How severe is CVE-2014-8881?

Low severity, with a CVSS score of 3.1, published 1 September 2020.

Which products and versions are affected?

bleach (npm) SEMVER:introduced=0.0.0.

Is there a fix for CVE-2014-8881?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2014-8881 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2014-8881?

Check whether you run bleach (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2014-8881: bleach regular expression denial of service

CVE-2014-8881 · Severity: low · CVSS 3.1 · Published 2020-09-01

bleach is a JavaScript library used to sanitize HTML content in web applications. A regular expression denial of service (ReDoS) vulnerability allows attackers to cause application unavailability by crafting specially formatted HTML input, potentially disrupting services that rely on this sanitization module.

Vendors: npm.

Quick answers

Is CVE-2014-8881 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2014-8881 being exploited in the wild.
How severe is CVE-2014-8881?: Low severity, with a CVSS score of 3.1, published 1 September 2020.
Which products and versions are affected?: bleach (npm) SEMVER:introduced=0.0.0.
Is there a fix for CVE-2014-8881?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2014-8881 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2014-8881?: Check whether you run bleach (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a regular expression denial of service (ReDoS) vulnerability in bleach's HTML sanitization function. The vulnerability stems from the library's use of inefficiently designed regular expressions to parse HTML without limiting input length, making it susceptible to catastrophic backtracking. An attacker can exploit this by sending crafted HTML input to any application using the sanitize function, causing excessive CPU consumption and rendering the service unavailable. No special privileges or user interaction are required—the attack is remotely exploitable over the network. The bleach package is no longer maintained (last update in 2014), and the vulnerability affects all versions. Migration to an actively maintained alternative HTML sanitization library is the recommended mitigation.

Affected products

bleach bleach all versions up to 3.0

Identifiers

CVE-2014-8881
GHSA-mvmf-cvfx-qg55

Timeline

2015-10-24: disclosed: Vulnerability disclosed to npm advisor
2020-09-01: advisory: GHSA-mvmf-cvfx-qg55 published

References

https://snyk.io/vuln/npm:bleach:20151024

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.