CVE-2017-0928: Cross-Site Scripting (XSS) in html-janitor
Summary
CVE-2017-0928: Bypassing Sanitization using DOM clobbering in html-janitor. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
html-janitor is an npm package that provides a sanitization process for HTML content. It is commonly used to clean user-controlled input to prevent cross-site scripting (XSS) attacks. However, all versions of html-janitor are vulnerable to a bypassing sanitization issue using DOM clobbering. This vulnerability allows arbitrary HTML to pass the sanitization process, potentially leading to XSS attacks if user-controlled input is passed to the clean function.
Vulnerability Detail
The vulnerability in html-janitor arises from the improper handling of user-controlled input during the sanitization process. This allows an attacker to inject arbitrary HTML code that will not be properly sanitized, leading to potential XSS attacks. The impact of this vulnerability can be severe, as it allows an attacker to execute malicious scripts in the context of a victim's browser, potentially compromising sensitive user data or performing unauthorized actions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version of html-janitor to mitigate the risk of XSS attacks.
Conclusion
The vulnerability in html-janitor allows for bypassing sanitization, potentially leading to cross-site scripting (XSS) attacks. It is crucial to upgrade to version 2.0.4 or later to fix this vulnerability and mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for html-janitor →
FAQ
html-janitor is an npm package that provides a sanitization process for HTML content, helping to prevent cross-site scripting (XSS) attacks.
The vulnerability allows an attacker to bypass the sanitization process in html-janitor, potentially leading to XSS attacks. This can result in the execution of malicious scripts in the context of a victim's browser, compromising sensitive user data or performing unauthorized actions.
To fix this vulnerability, it is recommended to upgrade to version 2.0.4 or later of html-janitor.
There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version of html-janitor to mitigate the risk of XSS attacks.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-fx46-whrj-73v5/GHSA-fx46-whrj-73v5.json
Related vulnerabilities
Recent vulnerabilities recorded for html-janitor.
