Lucene search

K
cnvdChina National Vulnerability DatabaseCNVD-2022-88818
HistorySep 28, 2022 - 12:00 a.m.

Express XSS Sanitizer prototype contamination vulnerability

2022-09-2800:00:00
China National Vulnerability Database
www.cnvd.org.cn
7
xss
sanitizer
vulnerability
express
prototype contamination
version
allowedtags
bypass filtering

EPSS

0.001

Percentile

45.1%

Express XSS Sanitizer is a personal development by AhmedAdelFahim to clean user input data (in req.body, req.query, req.headers and req.params) to prevent cross-site scripting (XSS) attacks. express XSS Sanitizer A prototype contamination vulnerability exists in versions prior to 1.1.3, which stems from the vulnerability that express-xss-sanitizer is susceptible to prototype contamination via the allowedTags attribute, which can be exploited to bypass xss filtering.

EPSS

0.001

Percentile

45.1%