GHSA-fx46-whrj-73v5

ghsaUSosv

Bypassing Sanitization using DOM clobbering in html-janitor

view advisory published 2018-07-24Licence: CC-BY-4.0

All versions of `html-janitor` are vulnerable to cross-site scripting (XSS). Arbitrary HTML can pass the sanitization process, which can be unexpected and dangerous (XSS) in case user-controlled input is passed to the clean function." ## Recommendation Upgrade to version 2.0.4 or later.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2017-0928US	medium6.1	1.02% (63rd)	—	2018-06-04
html-janitor node module suffers from an External Control of Critical State Data vulnerability via user-control of the '_sanitized' variable causing sanitization to be bypassed.

references

External citations — patches, advisories, analysis.

https://github.com/advisories/GHSA-fx46-whrj-73v5ADVISORY
https://github.com/guardian/html-janitor/issues/35WEB
https://hackerone.com/reports/308158WEB
https://nvd.nist.gov/vuln/detail/CVE-2017-0928ADVISORY
https://www.npmjs.com/advisories/569WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan