Executive brief
insane is a popular HTML sanitizer library used to clean and whitelist HTML content in web applications. A Regular Expression Denial of Service (ReDoS) vulnerability in the library's regex patterns allows an attacker to cause service disruptions by sending specially crafted HTML input that triggers excessive CPU consumption, potentially taking down or severely slowing applications that depend on it.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) flaw caused by inefficient regular expressions in the insane HTML sanitizer (CWE-1333). One or more regex patterns contain catastrophic backtracking behavior that can be triggered by maliciously crafted input. An attacker with network access can send specially constructed HTML to an application using insane, causing the regex engine to consume excessive CPU resources and potentially causing a denial of service. The attack requires no authentication or user interaction. As of the advisory publication, no patches are available for versions 2.6.2 and earlier.
Affected products
- npm insane 2.6.2 and prior
Timeline
- 2024-10-26: disclosed
- 2024-10-28: advisory