CVE-2025-5895

MEDIUM

Metabase 54.10 - Denial of Service via Inefficient Regular Expression in parseDataUri

Title source: llm
STIX 2.1

Description

A vulnerability was found in Metabase 54.10. It has been classified as problematic. This affects the function parseDataUri of the file frontend/src/metabase/lib/dom.js. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The patch is named 4454ebbdc7719016bf80ca0f34859ce5cee9f6b0. It is recommended to apply a patch to fix this issue.

References (6)

Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.311667
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.311667
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.585795
Exploit, Issue Tracking, Patch issue-tracking
https://github.com/metabase/metabase/pull/57011
Exploit, Issue Tracking, Patch exploit issue-tracking
https://github.com/metabase/metabase/pull/57011#pullrequestreview-2792664135

Scores

CVSS v3 4.3
EPSS 0.0050
EPSS Percentile 38.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-1333 CWE-400
Status published
Products (1)
metabase/metabase 0.54.10
Published Jun 09, 2025
Tracked Since Feb 18, 2026