UNKNOWN READ Vulnerability in Tidy-HTML5 Package
Summary
OSV-2025-581: UNKNOWN READ in tidy_fuzzer. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Tidy-HTML5 is an open-source library designed for cleaning up and formatting HTML code. It is widely used in web development to ensure that HTML documents are well-formed and compliant with web standards. The library is maintained under the OSS-Fuzz ecosystem, which focuses on improving the security and stability of open-source software through fuzz testing. However, like many software packages, Tidy-HTML5 is not immune to vulnerabilities, such as the UNKNOWN READ issue reported in its fuzzer component.
Vulnerability Detail
The UNKNOWN READ vulnerability in Tidy-HTML5 was identified through an OSS-Fuzz report, which highlighted a crash type associated with the tidy_fuzzer component. This vulnerability may allow an attacker to exploit the fuzzer to read unintended memory locations, potentially leading to information disclosure or application crashes. The specific crash state indicates that the fuzzer is not handling certain inputs correctly, which could be leveraged to manipulate the behavior of the application.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. However, users are advised to avoid using the fuzzer component in production environments until the vulnerability has been addressed in a stable release.
Conclusion
The UNKNOWN READ vulnerability in the Tidy-HTML5 package poses a risk to applications that utilize this library. It is crucial for developers to update to the latest version to mitigate potential security threats. Utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for tidy-html5 →
FAQ
The UNKNOWN READ vulnerability refers to a crash state in the tidy_fuzzer component of Tidy-HTML5, where the fuzzer attempts to read memory locations that it should not access.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. By simply uploading your manifest file, such as package-lock.json, you can check for vulnerabilities without needing to access the code.
Exploiting this vulnerability could lead to application crashes or information disclosure, which may compromise the security and stability of applications using Tidy-HTML5.
Yes, users are encouraged to update to the latest version of Tidy-HTML5, which includes patches for this vulnerability.
More information about Tidy-HTML5 can be found on its official GitHub repository and documentation pages.
References
Related vulnerabilities
Recent vulnerabilities recorded for tidy-html5.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
