GHSA-2v5f-23xc-v9qr

ansi_up cross-site scripting vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-3377

Packages

Ecosystem	Package	Affected	Fixed in
npm	ansi_up	< 5.0.0	5.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

The npm package ansi_up converts ANSI escape codes into HTML. In ansi_up v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, this feature is affected by a cross-site scripting (XSS) vulnerability. This issue is fixed in v5.0.0.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-3377 advisory
https://github.com/drudru/ansi_up/commit/c8c726ed1db979bae4f257b7fa41775155ba2e27 web
https://doyensec.com/resources/Doyensec_Advisory_ansi_up4_XSS.pdf web
https://security.netapp.com/advisory/ntap-20241108-0002 web