GHSA-hfj4-96f7-6r5g
Cross-Site Scripting in html-janitor
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | html-janitor | < 2.0.3 | 2.0.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
Versions of `html-janitor` prior to 2.0.2 (all current versions) are vulnerable to cross-site scripting (XSS).
This is exploitable if user-controlled data is passed into the modules `clean()` function.
## Recommendation
No fix is currently available for this vulnerability. It is recommended to use an alternative module for HTML sanitization.
References
External links from the advisory. They lead to third-party sites.