CVE-2025-5895: Metabase dom.js parseDataUri redos
A vulnerability was found in Metabase 54.10. It has been classified as problematic. This affects the function parseDataUri of the file frontend/src/metabase/lib/dom.js. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The patch is named 4454ebbdc7719016bf80ca0f34859ce5cee9f6b0. It is recommended to apply a patch to fix this issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5895?
CVE-2025-5895 is classified as a problematic vulnerability due to its impact on the function parseDataUri.
How do I fix CVE-2025-5895?
To fix CVE-2025-5895, users should update to the latest version of Metabase where the vulnerability has been addressed.
What feature of Metabase does CVE-2025-5895 affect?
CVE-2025-5895 affects the parseDataUri function in the frontend/src/metabase/lib/dom.js file.
Can CVE-2025-5895 be exploited remotely?
Yes, CVE-2025-5895 can be exploited remotely by attackers manipulating the vulnerable function.
What type of vulnerability is CVE-2025-5895 associated with?
CVE-2025-5895 is associated with inefficient regular expression complexity, potentially leading to performance issues.