sanitize-html Information Exposure vulnerability

Description

Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies).

Recommendation

Update the sanitize-html package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.12.1
• Patched version(s): 2.12.1

References

• GHSA-rm97-x556-q36h
• security.snyk.io
• lists.fedoraproject.org
• CVE-2024-21501
• CWE-200
• CWE-538
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Cross-Site Scripting in sanitize-html - sanitize-html - GHSA-3j7m-hmh3-9jmp - CVE-2016-1000237
• sanitize-html is vulnerable to XSS through incomprehensive sanitization - CVE-2019-25225
• sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements - CVE-2026-40186
• Improper Input Validation in sanitize-html - CVE-2021-26539

You might also like:

Exploiting Server Version Disclosure

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

sanitize-html