CVE-2022-48345: 
JavaScript vulnerability analysis and mitigation

The vulnerability CVE-2022-48345 affects sanitize-url (also known as @braintree/sanitize-url) versions before 6.0.2. This security issue was disclosed on February 24, 2023, and involves a Cross-Site Scripting (XSS) vulnerability that can be exploited via HTML entities (NVD, CVE).

The vulnerability has a CVSS v3.1 Base Score of 6.1 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The issue specifically involves improper sanitization of URLs that contain HTML entities, which could lead to XSS attacks. The vulnerability affects the URL sanitization process where HTML-encoded characters, particularly colons and tabs, were not properly handled (GitHub Patch).

The vulnerability allows attackers to potentially execute cross-site scripting (XSS) attacks through URLs containing HTML entities. This could lead to limited impact on confidentiality and integrity of the affected systems, though there is no impact on system availability (NVD).

The vulnerability has been fixed in version 6.0.2 of the sanitize-url package. Users are advised to upgrade to this version or later to mitigate the security risk. The fix includes improvements to handle HTML-encoded characters and proper sanitization of malicious URLs (GitHub Release).