@braintree/sanitize-url Cross-site Scripting vulnerability

Description

sanitize-url (aka @braintree/sanitize-url) before 6.0.1 allows XSS via HTML entities.

Recommendation

Update the @braintree/sanitize-url package to the latest compatible version. Followings are version details:

• Affected version(s): < 6.0.1
• Patched version(s): 6.0.1

References

• GHSA-q8gg-vj6m-hgmj
• CVE-2022-48345
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Cross-site Scripting in sanitize-url - CVE-2021-23648
• Reflected cross-site scripting (XSS) vulnerability - CVE-2022-0087
• jplayer Cross Site Scripting vulnerability - CVE-2013-2022
• CKEditor5 cross-site scripting vulnerability caused by the editor instance destroying process - CVE-2022-31175

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

Tags:

npm

@braintree/sanitize-url