Cross-Site Scripting in sanitize-html
Moderate severity
GitHub Reviewed
Published
Nov 9, 2018
to the GitHub Advisory Database
•
Updated Sep 8, 2023
Description
Published to the GitHub Advisory Database
Nov 9, 2018
Reviewed
Jun 16, 2020
Last updated
Sep 8, 2023
Affected versions of
sanitize-htmlare vulnerable to cross-site scripting.Proof of Concept:
<IMG SRC= onmouseover="alert('XSS');">produces the following:
<img src="onmouseover="alert('XSS');"" />This is definitely invalid HTML, but would suggest that it's being interpreted incorrectly by the parser.
Recommendation
Update to version 1.2.3 or later.
References