CVE-2021-26539

Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name IDN which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option...

PT-2021-17026

Name of the Vulnerable Software and Affected Versions sanitize-html versions prior to 2.3.1 Description The issue arises from improper handling of internationalized domain names IDN, which could allow an attacker to bypass hostname whitelist validation set by the allowedIframeHostnames option. Th...

PT-2021-17027

Name of the Vulnerable Software and Affected Versions sanitize-html versions prior to 2.3.2 Description The issue arises from improper validation of hostnames set by the allowedIframeHostnames option when allowIframeRelativeUrls is set to true. This allows attackers to bypass the hostname whiteli...

Abea Apostrophe Technologies sanitize-html input validation error vulnerability

Abea Apostrophe Technologies sanitize-html is a formatting removal tool organized by Abea USA. It provides simple HTML tag removal with a clear API. An input validation error vulnerability exists in Apostrophe Technologies sanitize-html that stems from failure to properly validate hostnames set b...

Abea Apostrophe Technologies sanitize-html security vulnerability

Abea Apostrophe Technologies sanitize-html is a formatting removal tool organized by Abea USA. It provides simple HTML tag removal with a clear API. A security vulnerability exists in Apostrophe Technologies sanitize-html versions prior to 2.3.1, which stems from the inability to properly handle...

GHSA-3J7M-HMH3-9JMP Cross-Site Scripting in sanitize-html

Affected versions of sanitize-html do not sanitize input recursively, which may allow an attacker to execute arbitrary Javascript. Recommendation Update to version 1.4.3 or later...

apostrophe-tumblr (>=0.5.1, <=0.5.13), http-teapot-comment (0.1.0) +1 more potentially affected by CVE-2016-1000237 via sanitize-html (>=1.1.4, <=1.4.2)

sanitize-html NPM version =1.1.4, =0.5.1, =0.5.13 - http-teapot-comment 0.1.0 - piedpiper-middle-out 5.8.1 Source cves: CVE-2016-1000237 Source advisory: OSV:GHSA-3J7M-HMH3-9JMP...

Cross-Site Scripting in sanitize-html

Affected versions of sanitize-html do not sanitize input recursively, which may allow an attacker to execute arbitrary Javascript. Recommendation Update to version 1.4.3 or later...

CVE-2016-1000237

sanitize-html before 1.4.3 has XSS...

CVE-2016-1000237

sanitize-html before 1.4.3 has XSS...

Cross site scripting

sanitize-html before 1.4.3 has XSS...

CVE-2016-1000237

CVE-2016-1000237 affects sanitize-html prior to 1.4.3, where input is not sanitized recursively which may allow XSS. Documented in multiple sources (Node.js advisory GHSA-3J7M-HMH3-9JMP, Red Hat, Debian, NVD/NVD list). Impact is cross-site scripting via vulnerable sanitize-html versions; exploita...

CVE-2016-1000237

sanitize-html before 1.4.3 has XSS...

CVE-2016-1000237

sanitize-html before 1.4.3 has XSS...

PT-2020-7942

Name of the Vulnerable Software and Affected Versions: sanitize-html versions prior to 1.4.3 Description: The issue allows an attacker to execute arbitrary Javascript due to the lack of recursive sanitization of input in affected versions of sanitize-html. Recommendations: Update to version 1.4.3...

Cross-Site Scripting (XSS)

sanitize-html is vulnerable to cross-site scripting XSS. The opentag function in index.js fails to sanitize HTML attributes when sanitizing HTML tags that have been modified using a custom tag transformation. If an application uses custom tag transformations, and places user input in an HTML...

GHSA-XC6G-GGRC-QQ4R Cross-Site Scripting in sanitize-html

Affected versions of sanitize-html are vulnerable to cross-site scripting when allowedTags includes at least one nonTextTag. Proof of Concept js var sanitizeHtml = require'sanitize-html'; var dirty = '!/textarea!'; var clean = sanitizeHtmldirty, allowedTags: 'textarea' ; console.logclean; // !!...

apostrophe (>=0.5.235, <=0.5.299), apostrophe-tumblr (>=0.5.1, <=0.5.13) +5 more potentially affected by CVE-2017-16016 via sanitize-html (>=1.1.4, <=1.10.1)

sanitize-html NPM version =1.1.4, =0.5.235, =0.5.1, =0.1.0-beta.6, =0.5.1, =0.0.1, =0.0.9 Source cves: CVE-2017-16016 Source advisory: OSV:GHSA-XC6G-GGRC-QQ4R...

Cross-Site Scripting in sanitize-html

Affected versions of sanitize-html are vulnerable to cross-site scripting when allowedTags includes at least one nonTextTag. Proof of Concept js var sanitizeHtml = require'sanitize-html'; var dirty = '!/textarea!'; var clean = sanitizeHtmldirty, allowedTags: 'textarea' ; console.logclean; // !!...

GHSA-WG96-3933-J2W5 Cross-Site Scripting in sanitize-html

Affected versions of sanitize-html are vulnerable to cross-site scripting. Proof of Concept: produces the following: This is definitely invalid HTML, but would suggest that it's being interpreted incorrectly by the parser. Recommendation Update to version 1.2.3 or later...