CVE-2017-16016: Cross-Site Scripting in sanitize-html
Summary
CVE-2017-16016: Cross-Site Scripting in sanitize-html. Affects sanitize-html versions < 1.11.4. Fixed in 1.11.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sanitize-html package is an npm package that provides a way to sanitize HTML input by removing potentially malicious code. It is commonly used in web applications to prevent cross-site scripting (XSS) attacks. However, certain versions of sanitize-html are vulnerable to a specific type of XSS attack when the allowedTags configuration includes at least one nonTextTag.
Vulnerability Detail
The vulnerability in sanitize-html allows an attacker to execute arbitrary JavaScript code in the context of a user's browser. By including a specially crafted payload in an HTML input field, the attacker can bypass the sanitization process and inject malicious code that will be executed when the input is rendered. This can lead to various consequences, such as stealing sensitive user information, performing actions on behalf of the user, or modifying the appearance and behavior of the web page.
How To Fix
Minimum fixed version
1.11.4
This is the first release that contains the fix.
npm install sanitize-html@1.11.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not immediately feasible, a temporary workaround can be implemented by removing any nonTextTag elements from the allowedTags configuration. This can be done by modifying the code that utilizes the sanitize-html package and explicitly specifying only the necessary tags to be allowed.
Conclusion
The sanitize-html package is vulnerable to a cross-site scripting (XSS) attack when certain configurations are used. To protect your application, it is crucial to update to version 1.11.4 or later of the package. If immediate updating is not possible, removing nonTextTag elements from the allowedTags configuration can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sanitize-html →
FAQ
This vulnerability allows an attacker to execute arbitrary JavaScript code in the context of a user's browser, potentially leading to unauthorized actions, data theft, or website defacement.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any known vulnerabilities, including this XSS vulnerability in sanitize-html.
Yes, updating to version 1.11.4 or later of the sanitize-html package will fix this vulnerability. It is recommended to always keep your dependencies up to date to ensure the security of your application.
Yes, if updating to the latest version is not immediately feasible, you can remove any nonTextTag elements from the allowedTags configuration in your code. However, it is still strongly recommended to update to the latest version as soon as possible to ensure the security of your application.
There have been reported instances of this vulnerability being exploited in the wild. It is important to promptly update your sanitize-html package to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for sanitize-html.
