CVE-2022-35142
Description
An issue in Renato v0.17.0 allows attackers to cause a Denial of Service (DoS) via a crafted payload injected into the Search parameter.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
ranetonpm | < 0.17.1 | 0.17.1 |
Affected products
1Patches
Vulnerability mechanics
Root cause
"Insufficient input sanitization in the search route allows a crafted payload to crash the search handler, causing a Denial of Service."
Attack vector
An attacker sends a crafted HTTP GET request to the search endpoint with a malicious payload in the `search` query parameter. The original code only stripped `
Affected code
The vulnerability resides in the search route handler at `app/routes/search.route.js`. The original code used `_s.stripTags()` to remove `
What the fix does
The patch introduces a new `app/functions/sanitize.js` module that applies `validator.blacklist`, `validator.trim`, and `validator.escape` to the search query, removing dangerous characters (`&'"/>
Preconditions
- networkThe attacker must be able to send HTTP requests to the Raneto search endpoint (typically /search?search=...).
- authNo authentication is required; the search endpoint is publicly accessible.
Generated on May 23, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
11- github.com/advisories/GHSA-xxc2-j7jj-6g5mghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-35142ghsaADVISORY
- raneto.comghsaWEB
- raneto.commitrex_refsource_MISC
- cwe.mitre.org/data/definitions/703.htmlghsax_refsource_MISCWEB
- gainsec.com/2022/08/04/cve-2022-35142-cve-2022-35143-cve-2022-35144ghsaWEB
- gainsec.com/2022/08/04/cve-2022-35142-cve-2022-35143-cve-2022-35144/mitrex_refsource_MISC
- github.com/gilbitron/Raneto/releasesghsax_refsource_MISCWEB
- github.com/ryanlelek/Raneto/issues/368ghsaWEB
- github.com/ryanlelek/Raneto/pull/370ghsaWEB
- github.com/ryanlelek/Raneto/releases/tag/0.17.1ghsaWEB
News mentions
0No linked articles in our index yet.