Description
Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the “allowedIframeHostnames” option when the “allowIframeRelativeUrls” is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with “/\example.com”.
Recommendation
Update the sanitize-html package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.3.2
- Patched version(s): 2.3.2
References
Could your website be exposed too?
SmartScanner can check your website for Improper Input Validation in sanitize-html - sanitize-html and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Improper Input Validation in sanitize-html - CVE-2021-26539
- sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, pos - CVE-2026-53606
- Improper Input Validation in is-email - CVE-2021-36716
- sanitize-html Information Exposure vulnerability - CVE-2024-21501
You might also like:
See something that needs correcting? Let us knowUpdated February 01, 2023