Vulnerability · Published Jun 9, 2025 · Assigned by VulDB

CVE-2025-5895Metabase dom.js parseDataUri redos

Medium 4.3

In plain English

A medium-severity regular-expression denial of service in Metabase. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.7%top 47.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in Metabase 54.10. It has been classified as problematic. This affects the function parseDataUri of the file frontend/src/metabase/lib/dom.js. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The patch is named 4454ebbdc7719016bf80ca0f34859ce5cee9f6b0. It is recommended to apply a patch to fix this issue.

Affected products (as reported)

Vendor	Product	Versions
n/a	Metabase	54.10

Weakness: CWE-1333, CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

References

VDB-311667 | Metabase dom.js parseDataUri redos vdb-entry, technical-description
VDB-311667 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #585795 | metabase @metabase 54.10 Inefficient Regular Expression Complexity third-party-advisory
https://github.com/metabase/metabase/pull/57011 issue-tracking
https://github.com/metabase/metabase/pull/57011#pullrequestreview-2792664135 exploit, issue-tracking
https://github.com/metabase/metabase/commit/4454ebbdc7719016bf80ca0f34859ce5cee9f6b0 patch