Bypassing Sanitization using DOM clobbering in html-janitor

Description

All versions of html-janitor are vulnerable to cross-site scripting (XSS).

Arbitrary HTML can pass the sanitization process, which can be unexpected and dangerous (XSS) in case user-controlled input is passed to the clean function.”

Recommendation

No fix is available yet. Followings are affected versions:

< 2.0.4

References

GHSA-fx46-whrj-73v5
hackerone.com
www.npmjs.com
CVE-2017-0928
CWE-547
CWE-642
CAPEC-310
OWASP 2021-A4
OWASP 2021-A5
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for Bypassing Sanitization using DOM clobbering in html-janitor and gives you actionable findings to investigate.

Start a free scan

Related Issues

Cross-Site Scripting in html-janitor - CVE-2017-0931
Sanitization bypass using HTML Entities in marked - CVE-2016-10531
Cross-Site Scripting in sanitize-html - CVE-2017-16017
Marp Core allows XSS by improper neutralization of HTML sanitization - CVE-2024-56510

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated September 12, 2023