Improper Input Validation in sanitize-html

Description

Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the “allowedIframeHostnames” option.

Recommendation

Update the sanitize-html package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.3.1
• Patched version(s): 2.3.1

References

• GHSA-rjqq-98f6-6j3r
• advisory.checkmarx.net
• CVE-2021-26539
• CWE-20
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• static-server Path Traversal vulnerability - CVE-2023-26152
• sanitize-html is vulnerable to XSS through incomprehensive sanitization - CVE-2019-25225
• chromedriver Downloads Resources over HTTP - CVE-2016-10579
• Denial of service in http-proxy-middleware - CVE-2024-21536

Tags:

npm

sanitize-html