GitHub Advisoryadvisory · npm

GHSA-grjp-4jmr-mjcw express-xss-sanitizer vulnerable to Prototype Pollution via allowedTags attribute

MEDIUM Published 2022-09-27 Modified 2022-09-30 Official page ↗
Aliases
CVE-2022-21169
Ecosystem
npm
Packages
express-xss-sanitizer
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-1321
Reviewed
2022-09-30

Affected packages

• npm express-xss-sanitizer: < 1.1.3 → fixed in 1.1.3

Description

The package express-xss-sanitizer before 1.1.3 is vulnerable to Prototype Pollution via the `allowedTags` attribute, allowing the attacker to bypass xss sanitization.

Related

Alias · CVE (1)

  • CVE-2022-21169 The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker… vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References