Cross-Site Scripting in sanitize-html (GHSA-xc6g-ggrc-qq4r)

Description

Affected versions of sanitize-html are vulnerable to cross-site scripting when allowedTags includes at least one nonTextTag.

Recommendation

Update the sanitize-html package to the latest compatible version. Followings are version details:

• Affected version(s): <= 1.11.1
• Patched version(s): 1.11.4

References

• GHSA-xc6g-ggrc-qq4r
• npmjs.com
• www.npmjs.com
• CVE-2017-16016
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Cross-Site Scripting in sanitize-html - CVE-2017-16017
• Cross-Site Scripting in sanitize-html (GHSA-3j7m-hmh3-9jmp) - CVE-2016-1000237
• Cross-Site Scripting in i18next (GHSA-cmh5-qc8w-xvcq) - CVE-2017-16010
• Cross-Site Scripting in html-janitor - CVE-2017-0931

Tags:

npm

sanitize-html