html-minifier-4.0.0.tgz: 1 vulnerabilities (highest severity is: 7.5)
Opened this issue · 0 comments
Vulnerable Library - html-minifier-4.0.0.tgz
Highly configurable, well-tested, JavaScript-based HTML minifier.
Library home page: https://registry.npmjs.org/html-minifier/-/html-minifier-4.0.0.tgz
Found in HEAD commit: 6d9647c6b41573a1d30cef1f4a06c455ed027b71
Vulnerabilities
| CVE | Severity |  CVSS |
Dependency | Type | Fixed in (html-minifier version) | Remediation Possible** | Reachability |
|---|---|---|---|---|---|---|---|
| CVE-2022-37620 |  High |
7.5 | html-minifier-4.0.0.tgz | Direct | N/A | ❌ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2022-37620
Vulnerable Library - html-minifier-4.0.0.tgz
Highly configurable, well-tested, JavaScript-based HTML minifier.
Library home page: https://registry.npmjs.org/html-minifier/-/html-minifier-4.0.0.tgz
Dependency Hierarchy:
- ❌ html-minifier-4.0.0.tgz (Vulnerable Library)
Found in HEAD commit: 6d9647c6b41573a1d30cef1f4a06c455ed027b71
Found in base branch: main
Vulnerability Details
A Regular Expression Denial of Service (ReDoS) flaw was found in kangax html-minifier 4.0.0 via the candidate variable in htmlminifier.js.
Publish Date: 2022-10-31
URL: CVE-2022-37620
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High