Executive brief
lettersanitizer is a library used to sanitize and clean CSS in email templates and HTML content. A flaw in how it processes CSS @keyframes rules can cause it to enter an infinite loop, leading to a denial of service that freezes or crashes applications using this library, including the popular react-letter email rendering component.
Technical details
lettersanitizer versions prior to 1.0.2 contain improper handling of CSS at-rules, specifically the @keyframes at-rule, resulting in an infinite loop condition (CWE-835). The vulnerability is triggered when the library processes specially crafted CSS containing @keyframes rules, causing the parser to enter an unreachable exit condition. This is a network-reachable denial of service vulnerability with no authentication required, as malicious CSS can be injected through user input (e.g., email content, HTML forms). An attacker can craft a malicious CSS payload to consume CPU resources and cause the affected application to hang or crash. The issue has been patched in version 1.0.2.
Affected products
- mat-sz lettersanitizer <1.0.2
Timeline
- 2022-06-23: disclosed
- 2022-06-23: patched: Version 1.0.2 released