CVE-2020-26303

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

insane is a whitelist-oriented HTML sanitizer. Versions 2.6.2 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches are available.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1333

Affected software

No affected versions have been published.

Timeline

Published
Oct 26, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2020

CVE-2020-263047.5Foundation is a front-end framework. Versions 6.3.3 and prior contain one or more regular expressions that are vulnerable to Regular ExpressCVE-2020-263057.5CommonRegexJS is a CommonRegex port for JavaScript. All available versions contain one or more regular expressions that are vulnerable to ReCVE-2020-263068.7Knwl.js is a Javascript library that parses through text for dates, times, phone numbers, emails, places, and more. Versions 1.0.2 and priorCVE-2020-263078.7HTML2Markdown is a Javascript implementation for converting HTML to Markdown text. All available versions contain one or more regular expresCVE-2020-263087.5Validate.js provides a declarative way of validating javascript objects. Versions 0.13.1 and prior contain one or more regular expressions tCVE-2020-263098.7Validate.js provides a declarative way of validating javascript objects. Versions 0.11.3 and prior contain one or more regular expressions tCVE-2020-26316.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Application Service Level Mgmt). SuppCVE-2020-263108.7Validate.js provides a declarative way of validating javascript objects. All versions as of 30 November 2020 contain one or more regular expCVE-2020-263117.5Useragent is a user agent parser for Node.js. All versions as of time of publication contain one or more regular expressions that are vulnerCVE-2020-263128.1Dotmesh is a git-like command-line interface for capturing, organizing and sharing application states. In versions 0.8.1 and prior, the unsaCVE-2020-26326.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: System Monitoring). Supported versionCVE-2020-26336.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Connector Framework). Supported versi
CVE-2020-26303: High severity, CVSS 7.5 | Vulnix