CVE-2017-0931: Cross-Site Scripting in html-janitor
Summary
CVE-2017-0931: Cross-Site Scripting in html-janitor. Affects html-janitor versions < 2.0.3. Fixed in 2.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
html-janitor is an npm package used for HTML sanitization. It provides a clean() function that can be used to sanitize user-controlled data. Versions prior to 2.0.2 are vulnerable to cross-site scripting (XSS) attacks if user-controlled data is passed into the clean() function.
Vulnerability Detail
The vulnerability in html-janitor allows an attacker to inject malicious scripts into web pages, potentially leading to the theft of sensitive information or unauthorized actions on behalf of the user. This vulnerability is classified as CWE-79. It affects all versions of html-janitor prior to 2.0.2.
How To Fix
Minimum fixed version
2.0.3
This is the first release that contains the fix.
npm install html-janitor@2.0.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As there is no fix available, a possible workaround is to manually sanitize user-controlled data before passing it to the clean() function. This can be done using other HTML sanitization libraries or by implementing custom sanitization logic.
Conclusion
html-janitor versions prior to 2.0.2 are vulnerable to cross-site scripting (XSS) attacks. It is recommended to use an alternative module for HTML sanitization until a fix is provided. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for html-janitor →
FAQ
html-janitor is an npm package used for HTML sanitization. It provides a clean() function to sanitize user-controlled data.
The vulnerability allows an attacker to execute arbitrary scripts on web pages, potentially leading to sensitive data theft or unauthorized actions.
All versions of html-janitor prior to 2.0.2 are affected.
No, there is currently no fix available for this vulnerability.
A possible workaround is to manually sanitize user-controlled data before passing it to the clean() function using other HTML sanitization libraries or custom sanitization logic.
Related vulnerabilities
Recent vulnerabilities recorded for html-janitor.
