Reflected cross-site scripting (XSS) In sanitize-html
Description
Cross-Site Scripting in sanitize-html
Affected versions of sanitize-html are vulnerable to cross-site scripting.
Proof of Concept:
<IMG SRC= onmouseover="alert('XSS');">
produces the following:
<img src="onmouseover="alert('XSS');"" />
This is definitely invalid HTML, but would suggest that it's being interpreted incorrectly by the parser.
Recommendation
Update to version 1.2.3 or later.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 npm | 1.2.3 |
Aliases
1. 2. 3. 4. 5.
References
1. 2. 3.