CVE-2021-26540

MEDIUM5.3EPSS 0.29%

Improper Input Validation in sanitize-html

Published: 5/6/2021Modified: 11/8/2023
Also known as:GHSA-mjxr-4v3x-q3m4

Description

Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with "/\\example.com".

Affected packages (1)

CVSS scores

SourceVersionSeverityVector
osvCVSS 3.1MEDIUM5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References (4)