Cross-site Scripting in sanitize-url

Description

The package @braintree/sanitize-url before 6.0.0 is vulnerable to Cross-site Scripting (XSS) due to improper sanitization in the sanitizeUrl function.

Recommendation

Update the @braintree/sanitize-url package to the latest compatible version. Followings are version details:

• Affected version(s): < 6.0.0
• Patched version(s): 6.0.0

References

• GHSA-hqq7-2q2v-82xq
• snyk.io
• lists.fedoraproject.org
• CVE-2021-23648
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• @braintree/sanitize-url Cross-site Scripting vulnerability - CVE-2022-48345
• iziModal Cross-site Scripting vulnerability - CVE-2021-32860
• Cross-Site Scripting in sanitize-html - sanitize-html - CVE-2017-16016
• Cross-site Scripting in curly-bracket-parser - CVE-2021-23416

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@braintree/sanitize-url