GitHub Advisoryadvisory · npm

GHSA-fx46-whrj-73v5 Bypassing Sanitization using DOM clobbering in html-janitor

MEDIUM Published 2018-07-24 Modified 2023-09-12 Official page ↗
Aliases
CVE-2017-0928
Ecosystem
npm
Packages
html-janitor
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-547, CWE-642
Reviewed
2020-06-16

Affected packages

• npm html-janitor: < 2.0.4 (no fix yet)

Description

All versions of `html-janitor` are vulnerable to cross-site scripting (XSS). Arbitrary HTML can pass the sanitization process, which can be unexpected and dangerous (XSS) in case user-controlled input is passed to the clean function." Recommendation Upgrade to version 2.0.4 or later.

Related

Alias · CVE (1)

  • CVE-2017-0928 html-janitor node module suffers from an External Control of Critical State Data vulnerability via user-control of the '_sanitized'… vulnerability

Weakness · CWE (2)

  • CWE-547 Use of Hard-coded, Security-relevant Constants weakness
  • CWE-642 External Control of Critical State Data weakness

References