CVE-2022-4891

Sisimai string.rb to_plain redos

3.5 LowFix available

A vulnerability has been found in Sisimai up to 4.25.14p11 and classified as problematic. This vulnerability affects the function to_plain of the file lib/sisimai/string.rb. The manipulation leads to inefficient regular expression complexity. The exploit has been disclosed to the public and may be used. Upgrading to version 4.25.14p12 is able to address this issue. The name of the patch is 51fe2e6521c9c02b421b383943dc9e4bbbe65d4e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218452.

Attack profile

How easy it is to exploit

Attack vector: Adjacent network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: Low

Exploit likelihood

1.39%Up 0.4 points since Jan 18, 2023

What each source reports

CVE List Score used 3.5

Sisimai string.rb to_plain redos

Record: CVE-2022-4891
CVSS 3.1: 3.5 LowCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 3.0: 3.5 LowCVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0: 2.7 AV:A/AC:L/Au:S/C:N/I:N/A:P
Weakness: CWE-1333
Updated: 2026-11-02

EUVDEUVD-2023-0562 3.5

Record: EUVD-2023-0562
CVSS 3.1: 3.5 LowCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-03

GitHub AdvisoriesGHSA-vm74-j4wq-82xj 4.3

Sisimai Inefficient Regular Expression Complexity vulnerability

A vulnerability has been found in Sisimai up to 4.25.14p11 and classified as problematic. This vulnerability affects the function to_plain of the file lib/sisimai/string.rb. The manipulation leads to inefficient regular expression complexity. The exploit has been disclosed to the public and may be used. Upgrading to version 4.25.14p12 is able to address this issue. The name of the patch is 51fe2e6521c9c02b421b383943dc9e4bbbe65d4e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218452.

Record: GHSA-vm74-j4wq-82xj
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-1333
Updated: 2026-11-02

NVD 3.5

Record: CVE-2022-4891
CVSS 3.1: 3.5 LowCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 2.7 LowAV:A/AC:L/Au:S/C:N/I:N/A:P
Weakness: CWE-1333
Updated: 2026-11-02

OSV 3.5

Sisimai string.rb to_plain redos

Record: CVE-2022-4891
CVSS 3.1: 3.5 LowCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-1333
Updated: 2026-11-02

OSVGHSA-vm74-j4wq-82xj 4.3

Sisimai Inefficient Regular Expression Complexity vulnerability

Record: GHSA-vm74-j4wq-82xj
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-1333
Updated: 2026-11-02

Affected products

libsisimai sisimai

Affected packages

Affected packages
Package	Affected	Fixed
`sisimai` RubyGems	before 4.25.14p12	4.25.14p12
`sisimai` RubyGems	before 4.25.14p12, plus listed versions 4.14.24.15.04.15.14.16.04.17.0 Show 35 moreShow less 4.17.14.17.24.18.04.18.14.19.04.20.04.20.14.20.24.21.04.21.14.22.04.22.14.22.24.22.34.22.44.22.54.22.64.22.74.23.04.24.04.24.14.25.04.25.14.25.104.25.114.25.124.25.134.25.24.25.34.25.44.25.54.25.64.25.74.25.84.25.9	4.25.14p12

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-4891 is a low vulnerability (CVSS 3.5) in Libsisimai Sisimai, published January 17, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.39%, the 72nd percentile. Fixed in sisimai 4.25.14p12.

References

Show 5 moreShow less