VYPR
Get started
← All advisories
Medium severity4.3NVD Advisory· Published Jun 9, 2025· Updated Apr 29, 2026

CVE-2025-5895

CVE-2025-5895

Description

A vulnerability was found in Metabase 54.10. It has been classified as problematic. This affects the function parseDataUri of the file frontend/src/metabase/lib/dom.js. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The patch is named 4454ebbdc7719016bf80ca0f34859ce5cee9f6b0. It is recommended to apply a patch to fix this issue.

Affected products

1

Patches

1
4454ebbdc771

Fix inefficient regex (#57218)

https://github.com/metabase/metabaseRyan LaurieApr 25, 2025via nvd-ref
commit
2 files changed · +37 −2
  • frontend/src/metabase/lib/dom.js+3 −1 modified
    @@ -450,8 +450,10 @@ export function removeAllChildren(element) {
 }
 
 export function parseDataUri(url) {
+  // https://regexr.com/8e8gt
   const match =
-    url && url.match(/^data:(?:([^;]+)(?:;([^;]+))?)?(;base64)?,(.*)$/);
+    url &&
+    url.match(/^data:(?:([^;]+)(?:;([^;]+))?)?(;base64)?,((?:(?!\1|,).)*)$/);
   if (match) {
     let [, mimeType, charset, base64, data] = match;
     if (charset === "base64" && !base64) {
  • frontend/test/metabase/lib/dom.unit.spec.js+34 −1 modified
    @@ -1,4 +1,8 @@
-import { getSelectionPosition, setSelectionPosition } from "metabase/lib/dom";
+import {
+  getSelectionPosition,
+  parseDataUri,
+  setSelectionPosition,
+} from "metabase/lib/dom";
 
 describe("getSelectionPosition/setSelectionPosition", () => {
   let container;
@@ -21,3 +25,32 @@ describe("getSelectionPosition/setSelectionPosition", () => {
     expect(position).toEqual([3, 6]);
   });
 });
+
+describe("parseDataUri", () => {
+  it("parses a valid text data URI", () => {
+    const dataUri = "data:text/plain;base64,SGVsbG8sIFdvcmxkIQ==";
+    const result = parseDataUri(dataUri);
+    expect(result).toEqual({
+      mimeType: "text/plain",
+      charset: undefined,
+      data: "Hello, World!",
+      base64: "SGVsbG8sIFdvcmxkIQ==",
+    });
+  });
+
+  it("returns null for an invalid data URI", () => {
+    const invalidDataUri = "d4ta:text/plain;base64,SGVsbG8sIFdvcmxkIQ==";
+    const result = parseDataUri(invalidDataUri);
+    expect(result).toBeNull();
+  });
+
+  it("does not hang or crash on malicious DOS input", () => {
+    // Regex DOS vulnerability test vector
+    const malicious = "data:\u0000" + "\u0000,".repeat(100000) + "\n1\n";
+    const start = Date.now();
+    const result = parseDataUri(malicious);
+    const duration = Date.now() - start;
+    expect(result).toBeNull();
+    expect(duration).toBeLessThan(1000);
+  });
+});

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.