Design/Logic Flaw

2024-02-2405:15:00

PRIOn knowledge base

www.prio-n.com

sanitize-html

information exposure

backend

style attribute

file system

enumeration

vulnerability

attacker

6.9 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

13.1%

JSON

Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.