Improper Input Validation in sanitize-html

Description

Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the “allowedIframeHostnames” option.

Recommendation

Update the sanitize-html package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.3.1
• Patched version(s): 2.3.1

References

• GHSA-rjqq-98f6-6j3r
• advisory.checkmarx.net
• CVE-2021-26539
• CWE-20
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Improper Input Validation in sanitize-html (GHSA-mjxr-4v3x-q3m4) - CVE-2021-26540
• Improper Input Validation in Deap - CVE-2018-3749
• Sanitize-html Vulnerable To REDoS Attacks - CVE-2022-25887
• Improper Input Validation in url-js - CVE-2022-25839

Tags:

npm

sanitize-html