AIKIDO-2026-223593
html_sanitize_ex is vulnerable to Regular Expression Denial of Service (ReDoS)
82
High Risk
This Affects:
html_sanitize_exTL;DR
The CSS scrubber matches a declaration's property name with an unbounded pattern followed by a mandatory colon, so a long run of word characters not followed by a colon forces the regex engine to backtrack one character at a time and retry from every offset. The work grows quadratically with the length of the run, and no length cap is applied to the CSS handed to the scrubber. Sanitizing a large style value therefore consumes seconds of scheduler time and can saturate the scheduler pool, making the application unresponsive. The fix bounds the matching so long non-declaration input no longer triggers quadratic backtracking.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you sanitize content that reaches the CSS scrubber.
Background info
html_sanitize_ex is vulnerable to Regular Expression Denial of Service (ReDoS) in versions 0.3.1 - 1.5.2.
How to fix this
Upgrade the html_sanitize_ex library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant