GHSA-wg96-3933-j2w5MediumCVSS 6.1

Cross-Site Scripting in sanitize-html

Published
November 9, 2018
Last Modified
September 8, 2023

🔗 CVE IDs covered (1)

CVE-2017-16017 →

📋 Description

Affected versions of sanitize-html are vulnerable to cross-site scripting.

Proof of Concept:

<IMG SRC= onmouseover="alert('XSS');"> produces the following:

<img src="onmouseover="alert('XSS');"" /> This is definitely invalid HTML, but would suggest that it's being interpreted incorrectly by the parser.

Recommendation

Update to version 1.2.3 or later.

🎯 Affected products1

  • npm/sanitize-html:< 1.2.3

🔗 References (5)