~ / search / GHSA-qxg5-2qff-p49r

GHSA-qxg5-2qff-p49r

Passing in a non-string 'html' argument can lead to unsanitized output

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-32696

Packages

EcosystemPackageAffectedFixed in
npm striptags < 3.2.0 3.2.0

Details

As written in the advisory (Markdown source, shown as plain text).

A type-confusion vulnerability can cause `striptags` to concatenate unsanitized strings when an array-like object is passed in as the `html` parameter. This can be abused by an attacker who can control the shape of their input, e.g. if query parameters are passed directly into the function. ### Impact XSS ### Patches `3.2.0` ### Workarounds Ensure that the `html` parameter is a string before calling the function.

References

External links from the advisory. They lead to third-party sites.