GitHub Advisoryadvisory · npm

GHSA-mjxr-4v3x-q3m4 Improper Input Validation in sanitize-html

MEDIUM Published 2021-05-06 Modified 2021-03-29 Official page ↗
Aliases
CVE-2021-26540
Ecosystem
npm
Packages
sanitize-html
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-20
Reviewed
2021-03-29

Affected packages

• npm sanitize-html: < 2.3.2 → fixed in 2.3.2

Description

Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with "/\\example.com".

Related

Alias · CVE (1)

  • CVE-2021-26540 Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References