GHSA-fx46-whrj-73v5MediumCVSS 6.1

Bypassing Sanitization using DOM clobbering in html-janitor

Published
July 24, 2018
Last Modified
September 12, 2023

🔗 CVE IDs covered (1)

CVE-2017-0928 →

📋 Description

All versions of html-janitor are vulnerable to cross-site scripting (XSS).

Arbitrary HTML can pass the sanitization process, which can be unexpected and dangerous (XSS) in case user-controlled input is passed to the clean function."

Recommendation

Upgrade to version 2.0.4 or later.

🎯 Affected products1

  • npm/html-janitor:< 2.0.4

🔗 References (5)