GitHub Advisoryadvisory · npm

GHSA-xc6g-ggrc-qq4r Cross-Site Scripting in sanitize-html

MEDIUM Published 2018-11-09 Modified 2023-09-08 Official page ↗
Aliases
CVE-2017-16016
Ecosystem
npm
Packages
sanitize-html
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2020-06-16

Affected packages

• npm sanitize-html: < 1.11.4 → fixed in 1.11.4

Description

Affected versions of `sanitize-html` are vulnerable to cross-site scripting when allowedTags includes at least one `nonTextTag`. Proof of Concept ```js var sanitizeHtml = require('sanitize-html'); var dirty = '!&lt;/textarea&gt;!'; var clean = sanitizeHtml(dirty, { allowedTags: [ 'textarea' ] }); console.log(clean); // !! ``` Recommendation Update to version 1.11.4 or later.

Related

Alias · CVE (1)

  • CVE-2017-16016 Sanitize-html is a library for scrubbing html input of malicious values. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References