GHSA-3x58-xr87-2fcj

Cross-site scripting in bluemonday

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-29272

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/microcosm-cc/bluemonday	< 1.0.5	1.0.5

Details

As written in the advisory (Markdown source, shown as plain text).

bluemonday before 1.0.5 allows XSS because certain Go lowercasing converts an uppercase Cyrillic character, defeating a protection mechanism against the "script" string.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-29272 advisory
https://github.com/microcosm-cc/bluemonday/issues/111 web
https://github.com/microcosm-cc/bluemonday/commit/524f142fe46e945b7dcd291d7805c4b7dcf75bee web
https://github.com/microcosm-cc/bluemonday package
https://github.com/microcosm-cc/bluemonday/releases/tag/v1.0.5 web
https://pkg.go.dev/vuln/GO-2022-0762 web
https://vuln.ryotak.me/advisories/4 web
https://vuln.ryotak.me/advisories/4.txt web