CVE-2022-48345: XSS
Published Feb 24, 2023
·Updated
sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities.
Affected Software
7 affected components
Paypal Braintree\/sanitize-url Node.js<6.0.2
IBM Data Virtualization on Cloud Pak for Data<=3.0
IBM Watson Query on Cloud Pak for Data<=2.2
IBM Watson Query on Cloud Pak for Data<=2.1
IBM Watson Query on Cloud Pak for Data<=2.0
IBM Data Virtualization on Cloud Pak for Data<=1.8
IBM Data Virtualization on Cloud Pak for Data<=1.7
Remediation
Event History
Feb 24, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Aug 15, 2025
Data Sourced
via IBM·03:29 PM
DescriptionAffected Software
Frequently Asked Questions
1
What is CVE-2022-48345?
CVE-2022-48345 is a vulnerability in sanitize-url (aka @braintree/sanitize-url) before version 6.0.2 that allows XSS (Cross-Site Scripting) attacks via HTML entities.
2
What is the severity of CVE-2022-48345?
CVE-2022-48345 has a severity level of 6.1, which is classified as medium.
3
How can the sanitize-url vulnerability be exploited?
The sanitize-url vulnerability can be exploited by using HTML entities to inject malicious scripts into web applications.
4
Which software versions are affected by CVE-2022-48345?
Versions of sanitize-url (aka @braintree/sanitize-url) up to and excluding version 6.0.2 are affected by CVE-2022-48345.
5
How can I fix the sanitize-url vulnerability?
To fix the sanitize-url vulnerability, update to version 6.0.2 or later of sanitize-url (aka @braintree/sanitize-url).