Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2022-31103

Improper handling of CSS at-rules in lettersanitizer

Description

lettersanitizer is a DOM-based HTML email sanitizer for in-browser email rendering. All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule `@keyframes`. This package is depended on by [react-letter](https://github.com/mat-sz/react-letter), therefore everyone using react-letter is also at risk. The problem has been patched in version 1.0.2.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

mat-sz lettersanitizer

  • < 1.0.2affected

References