CVE-2022-31103 HIGH

CVE-2022-31103: Improper handling of CSS at-rules in lettersanitizer

Vendor Mat-Sz

Product lettersanitizer

Weakness CWE-754

Published June 27, 2022

Last update April 23, 2025

View on NVD All CVEs

CVSS base score

7.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality None

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

lettersanitizer is a DOM-based HTML email sanitizer for in-browser email rendering. All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule `@keyframes`. This package is depended on by [react-letter](https://github.com/mat-sz/react-letter), therefore everyone using react-letter is also at risk. The problem has been patched in version 1.0.2.

Key dates

02Disclosure timeline

June 27, 2022 CVE published

April 23, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-31103 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/754.html

Related vulnerabilities

04Related CVE

CVE-2025-59960 Junos OS and Junos OS Evolved: DHCP Option 82 messages from clients being passed unmodified to the DHCP server CVE-2024-39517 Junos OS and Junos OS Evolved: Upon processing specific L2 traffic, rpd can hang in devices with EVPN/VXLAN configured CVE-2025-53359 ethereum does not check transaction malleability for EIP-2930, EIP-1559 and EIP-7702 transactions CVE-2024-34694 LNbits improperly handles potential network and payment failures when using Eclair backend CVE-2025-21594 Junos OS: MX Series: In DS-lite and NAT scenario receipt of crafted IPv6 traffic causes port block