{"id":"CVE-2022-48345","details":"sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities.","aliases":["GHSA-q8gg-vj6m-hgmj"],"modified":"2026-08-12T03:51:15.890739054Z","published":"2023-02-24T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48345.json"},"references":[{"type":"WEB","url":"https://github.com/braintree/sanitize-url/compare/v6.0.1...v6.0.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48345.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48345"},{"type":"FIX","url":"https://github.com/braintree/sanitize-url/commit/d4bdc89f1743fe3cdb7c3f24b06e4c875f349b0c"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/braintree/sanitize-url","events":[{"introduced":"0"},{"fixed":"14a14e8e201d56dcd7726c30254690301ee03821"},{"fixed":"d4bdc89f1743fe3cdb7c3f24b06e4c875f349b0c"}],"database_specific":{"cpe":"cpe:2.3:a:paypal:braintree\\/sanitize-url:*:*:*:*:*:node.js:*:*","extracted_events":[{"introduced":"0"},{"fixed":"6.0.2"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v6.0.1","v6.0.0","v5.0.2","v5.0.1","v5.0.0","v4.1.1","v4.1.0","v4.0.1","v4.0.0","v3.1.0","2.1.0","2.0.2","2.0.1","2.0.0","1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-48345.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}