Description
Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the “allowedIframeHostnames” option.
Recommendation
Update the sanitize-html package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.3.1
- Patched version(s): 2.3.1
References
Could your website be exposed too?
SmartScanner can check your website for Improper Input Validation in sanitize-html and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Improper Input Validation in sanitize-html - sanitize-html - CVE-2021-26540
- sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, pos - CVE-2026-53606
- Improper Input Validation in is-email - CVE-2021-36716
- sanitize-html Information Exposure vulnerability - CVE-2024-21501
You might also like:
See something that needs correcting? Let us knowUpdated April 21, 2023