GitHub Advisoryadvisory · npm

GHSA-5p28-63mc-cgr9 Cross-Site Scripting bypass in html-purify

HIGH Published 2020-12-04 Modified 2020-12-04 Official page ↗
Ecosystem
npm
Packages
html-purify
Severity
High
Weaknesses
CWE-79
Reviewed
2020-12-04

Affected packages

• npm html-purify: <= 1.1.0 (no fix yet)

Description

All versions of html-purify are vulnerable to cross-site scripting. The data attribute inside of object tags is not properly sanitized and allows javascript URIs leading to code execution. No fix is currently available. Consider using an alternative package until a fix is made available.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References