CVE-2025-5895

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-5895
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-5895.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-5895
Published
2025-06-09T20:15:25.890Z
Modified
2026-04-10T05:31:39.310173Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

A vulnerability was found in Metabase 54.10. It has been classified as problematic. This affects the function parseDataUri of the file frontend/src/metabase/lib/dom.js. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The patch is named 4454ebbdc7719016bf80ca0f34859ce5cee9f6b0. It is recommended to apply a patch to fix this issue.

References

Affected packages

Git / github.com/metabase/metabase

Affected ranges

Type
GIT
Repo
https://github.com/metabase/metabase
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
0ad4d27ab0b30c7dcff3a81d5325e74ffe8f818c
Fixed
4454ebbdc7719016bf80ca0f34859ce5cee9f6b0
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.54.10"
        }
    ]
}

Affected versions

0.*
0.10.3
0.34.0-rc1
Other
blah
embedding-sdk-54-stable
nightly-ee
nightly-oss
rm
v20150601-alpha
v20150603-alpha
v20150604-alpha
embedding-sdk-0.*
embedding-sdk-0.1.0
embedding-sdk-0.1.10
embedding-sdk-0.1.11
embedding-sdk-0.1.12
embedding-sdk-0.1.13
embedding-sdk-0.1.14
embedding-sdk-0.1.15
embedding-sdk-0.1.16
embedding-sdk-0.1.17
embedding-sdk-0.1.18
embedding-sdk-0.1.19
embedding-sdk-0.1.2
embedding-sdk-0.1.20
embedding-sdk-0.1.21
embedding-sdk-0.1.22
embedding-sdk-0.1.23
embedding-sdk-0.1.24
embedding-sdk-0.1.25
embedding-sdk-0.1.26
embedding-sdk-0.1.27
embedding-sdk-0.1.28
embedding-sdk-0.1.29
embedding-sdk-0.1.30
embedding-sdk-0.1.31
embedding-sdk-0.1.32
embedding-sdk-0.1.33
embedding-sdk-0.1.34
embedding-sdk-0.1.35
embedding-sdk-0.1.36
embedding-sdk-0.1.37
embedding-sdk-0.1.38
embedding-sdk-0.1.4
embedding-sdk-0.1.5
embedding-sdk-0.1.6
embedding-sdk-0.1.7
embedding-sdk-0.1.8
embedding-sdk-0.1.9
embedding-sdk-0.52.1-nightly
embedding-sdk-0.52.2-nightly
embedding-sdk-0.52.3-nightly
embedding-sdk-0.52.4-nightly
embedding-sdk-0.53.1-nightly
embedding-sdk-0.54.1-nightly
embedding-sdk-0.54.10
embedding-sdk-0.54.11
embedding-sdk-0.54.12
embedding-sdk-0.54.13
embedding-sdk-0.54.2-nightly
embedding-sdk-0.54.3-nightly
embedding-sdk-0.54.4-nightly
embedding-sdk-0.54.5
embedding-sdk-0.54.6
embedding-sdk-0.54.7
embedding-sdk-0.54.8
embedding-sdk-0.54.9
embedding-sdk-1.*
embedding-sdk-1.52.1
v0.*
v0.10.0
v0.10.3
v0.10.4
v0.10.4.1
v0.11.0
v0.11.1
v0.11.2
v0.11.3
v0.12.0
v0.12.0-test
v0.13.0
v0.26.0.RC1
v0.35.0
v0.35.0-rc1
v0.35.0-rc2
v0.36.0-snapshot
v0.37.0-rc2
v0.38.0-preview
v0.38.0-rc1
v0.38.0-rc2
v0.38.0-rc3
v0.38.0-rc4
v0.40.0
v0.40.0-rc1-dan
v0.40.0-rc2
v0.41.0-RC1
v0.42.0-preview1
v0.43.0-rc1
v0.44.0-RC1
v0.45.0-RC1
v0.45.0-RC2
v0.47.0-RC1
v0.48.0-RC1
v0.52.0-beta
v0.54.0-beta
v0.54.0.1-beta
v0.54.0.2-beta
v0.54.0.3-beta
v0.54.0.x
v0.54.1
v0.54.1.1
v0.54.1.2
v0.54.1.3
v0.54.1.4
v0.54.1.5
v0.54.1.x
v0.54.10
v0.54.10.1
v0.54.10.2
v0.54.10.3
v0.54.10.5
v0.54.10.x
v0.54.2
v0.54.2.1
v0.54.2.2
v0.54.2.3
v0.54.2.4
v0.54.2.5
v0.54.2.x
v0.54.3
v0.54.3.1
v0.54.3.2
v0.54.3.3
v0.54.3.4
v0.54.3.5
v0.54.3.x
v0.54.4
v0.54.4.1
v0.54.4.2
v0.54.4.3
v0.54.4.4
v0.54.4.x
v0.54.5
v0.54.5.1
v0.54.5.2
v0.54.5.3
v0.54.5.4
v0.54.5.5
v0.54.5.x
v0.54.6
v0.54.6.1
v0.54.6.2
v0.54.6.x
v0.54.7
v0.54.7.x
v0.54.8
v0.54.8.x
v0.54.9
v0.54.9.1
v0.54.9.2
v0.54.9.3
v0.54.9.4
v0.54.9.5
v0.54.9.x
v0.9-final
v1.*
v1.40.0
v1.40.0-rc2
v1.41.0-RC1
v1.42.0-preview1
v1.42.0-rc2
v1.43.0-rc1
v1.44.0-RC1
v1.45.0-RC1
v1.45.0-RC2
v1.47.0-RC1
v1.48.0-RC1
v1.52.0-beta

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-5895.json"