{"id":"CVE-2022-48345","aliases":["DEBIAN-CVE-2022-48345","EUVD-2023-0773","GHSA-q8gg-vj6m-hgmj","UBUNTU-CVE-2022-48345"],"status":"published","title":"@braintree/sanitize-url Cross-site Scripting vulnerability","description":"sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.0056,"percentile":0.47044,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2023-02-24T00:00:00Z","modified":"2026-10-28T02:30:26Z","fixes":[{"ecosystem":"npm","package":"@braintree/sanitize-url","fixed_in":["6.0.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@braintree/sanitize-url","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.1"}]}]},{"source":"osv","ecosystem":"npm","package":"@braintree/sanitize-url","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.0.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-mermaid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.7.0+ds+~cs27.17.17-3","8.13.3+ds+~cs26.13.21-1","8.13.3+ds+~cs26.13.21-2","8.13.8+~cs10.4.16-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-mermaid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.2+~2.0.0-1","9.2.2+~2.0.0-2"]}],"products":[{"vendor":"paypal","product":"braintree\\/sanitize-url"}],"references":[{"url":"https://github.com/braintree/sanitize-url/commit/d4bdc89f1743fe3cdb7c3f24b06e4c875f349b0c","tags":["x_transferred","Patch","fix","web","report"]},{"url":"https://github.com/braintree/sanitize-url/compare/v6.0.1...v6.0.2","tags":["x_transferred","Patch","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48345","tags":["advisory"]},{"url":"https://github.com/braintree/sanitize-url/compare/v6.0.0...v6.0.1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q8gg-vj6m-hgmj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48345.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-48345","tags":["advisory"]},{"url":"https://github.com/braintree/sanitize-url","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2022-48345","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-48345","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-48345","description":"sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities.","status":"published","published":"2023-02-24T00:00:00Z","modified":"2025-03-12T15:36:20.862Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:33.913527Z"}],"euvd":[{"id":"EUVD-2023-0773","description":"sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities.","status":"published","published":"2023-02-24T00:00:00Z","modified":"2025-03-12T15:36:20Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:53:06.438267Z"}],"ghsa":[{"id":"GHSA-q8gg-vj6m-hgmj","title":"@braintree/sanitize-url Cross-site Scripting vulnerability","description":"sanitize-url (aka @braintree/sanitize-url) before 6.0.1 allows XSS via HTML entities.","status":"published","published":"2023-02-24T06:30:16Z","modified":"2023-03-03T00:11:25Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:46.526285Z"}],"nvd":[{"id":"CVE-2022-48345","description":"sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities.","status":"published","published":"2023-02-24T06:15:11.317Z","modified":"2026-06-17T05:15:12.383Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:36.601381Z"}],"osv":[{"id":"CVE-2022-48345","description":"sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities.","status":"published","published":"2023-02-24T00:00:00Z","modified":"2026-10-28T02:30:26.786339268Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:27.776402Z"},{"id":"DEBIAN-CVE-2022-48345","description":"sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities.","status":"withdrawn","published":"2023-02-24T06:15:11.317Z","modified":"2026-07-18T08:01:36.27999531Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:37.849341Z"},{"id":"GHSA-q8gg-vj6m-hgmj","title":"@braintree/sanitize-url Cross-site Scripting vulnerability","description":"sanitize-url (aka @braintree/sanitize-url) before 6.0.1 allows XSS via HTML entities.","status":"published","published":"2023-02-24T06:30:16Z","modified":"2023-11-08T04:11:03.001818Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:54.40888Z"},{"id":"UBUNTU-CVE-2022-48345","description":"sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities.","status":"published","published":"2023-02-24T06:15:00Z","modified":"2026-10-17T12:55:59.669314687Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:56.473586Z"}]}}