What is GHSA-mjxr-4v3x-q3m4?

GHSA-mjxr-4v3x-q3m4 is a security advisory published by GitHub Security Advisories with Medium severity. Improper Input Validation in sanitize-html

Which CVE IDs does GHSA-mjxr-4v3x-q3m4 cover?

GHSA-mjxr-4v3x-q3m4 covers the following CVE IDs: CVE-2021-26540. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mjxr-4v3x-q3m4?

GHSA-mjxr-4v3x-q3m4 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-mjxr-4v3x-q3m4?

GHSA-mjxr-4v3x-q3m4 affects 1 product, including: npm/sanitize-html:\u003c 2.3.2.

GHSA-mjxr-4v3x-q3m4MediumCVSS 5.3

Improper Input Validation in sanitize-html

Vendor

GitHub Security Advisories

Published

May 6, 2021

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2021-26540 →

📋 Description

Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with "/\example.com".

🎯 Affected products1

npm/sanitize-html:< 2.3.2

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2021-26540
https://github.com/apostrophecms/sanitize-html/pull/460
https://advisory.checkmarx.net/advisory/CX-2021-4309
https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#232-2021-01-26
https://github.com/advisories/GHSA-mjxr-4v3x-q3m4