What is GHSA-2v5f-23xc-v9qr?

GHSA-2v5f-23xc-v9qr is a security advisory published by GitHub Security Advisories with Medium severity. ansi_up cross-site scripting vulnerability

Which CVE IDs does GHSA-2v5f-23xc-v9qr cover?

GHSA-2v5f-23xc-v9qr covers the following CVE IDs: CVE-2021-3377. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2v5f-23xc-v9qr?

GHSA-2v5f-23xc-v9qr has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-2v5f-23xc-v9qr?

GHSA-2v5f-23xc-v9qr affects 1 product, including: npm/ansi_up:\u003c 5.0.0.

GHSA-2v5f-23xc-v9qrMediumCVSS 6.1

ansi_up cross-site scripting vulnerability

Vendor

GitHub Security Advisories

Published

March 11, 2021

Last Modified

November 4, 2025

🔗 CVE IDs covered (1)

CVE-2021-3377 →

📋 Description

The npm package ansi_up converts ANSI escape codes into HTML. In ansi_up v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, this feature is affected by a cross-site scripting (XSS) vulnerability. This issue is fixed in v5.0.0.

🎯 Affected products1

npm/ansi_up:< 5.0.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2021-3377
https://github.com/drudru/ansi_up/commit/c8c726ed1db979bae4f257b7fa41775155ba2e27
https://doyensec.com/resources/Doyensec_Advisory_ansi_up4_XSS.pdf
https://security.netapp.com/advisory/ntap-20241108-0002
https://github.com/advisories/GHSA-2v5f-23xc-v9qr