GHSA-rjqq-98f6-6j3r

Improper Input Validation in sanitize-html

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-26539

Packages

Ecosystem	Package	Affected	Fixed in
npm	sanitize-html	< 2.3.1	2.3.1

Details

As written in the advisory (Markdown source, shown as plain text).

Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-26539 advisory
https://github.com/apostrophecms/sanitize-html/pull/458 web
https://github.com/apostrophecms/sanitize-html/commit/bdf7836ef8f0e5b21f9a1aab0623ae8fcd09c1da web
https://advisory.checkmarx.net/advisory/CX-2021-4308 web
https://github.com/apostrophecms/sanitize-html package
https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#231-2021-01-22 web