Cross-Site Scripting in html-janitor

Description

Versions of html-janitor prior to 2.0.2 (all current versions) are vulnerable to cross-site scripting (XSS).

This is exploitable if user-controlled data is passed into the modules clean() function.

Recommendation

Update the html-janitor package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.0.3
• Patched version(s): 2.0.3

References

• GHSA-hfj4-96f7-6r5g
• hackerone.com
• www.npmjs.com
• CVE-2017-0931
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• tRPC 11 WebSocket DoS Vulnerability - CVE-2025-43855
• DocsGPT Allows Remote Code Execution - CVE-2025-0868
• Signature Malleabillity in elliptic - CVE-2020-13822
• Joplin Vulnerable to Code Injection - CVE-2022-23340

Tags:

npm

html-janitor