Moderate severityNVD Advisory· Published Oct 26, 2024· Updated Oct 28, 2024

GHSL-2020-289: Regular Expression Denial of Service (ReDoS) in insane

CVE-2020-26303

Description

insane is a whitelist-oriented HTML sanitizer. Versions 2.6.2 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches are available.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
insanenpm	<= 2.6.2	—

Affected products

ghsa-coords
pkg:npm/insane
Range: <= 2.6.2
bevacqua/insanev5
Range: 0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-w455-mfq9-hf74ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2020-26303ghsaADVISORY
securitylab.github.com/advisories/GHSL-2020-289-redos-insaneghsaADVISORY
github.com/bevacqua/insane/issues/19ghsaWEB
securitylab.github.com/advisories/GHSL-2020-289-redos-insane/mitre

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000