CVE-2024-21501: sanitize-html Information Exposure vulnerability
Summary
CVE-2024-21501: sanitize-html Information Exposure vulnerability. Affects sanitize-html versions < 2.12.1. Fixed in 2.12.1. How to fix ↓
Also tracked for
- node-sanitize-html · Debian:12
The same CVE-2024-21501 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
sanitize-html is an npm package used for sanitizing HTML input to prevent cross-site scripting (XSS) attacks. It provides a simple and configurable way to sanitize user-generated content before rendering it in web applications. The package is widely used in backend environments to sanitize HTML content and remove potentially malicious code. However, versions of sanitize-html before 2.12.1 are vulnerable to an Information Exposure vulnerability when used on the backend and with the style attribute allowed. This vulnerability allows an attacker to enumerate files in the system, including project dependencies, by exploiting the style attribute. By gathering details about the file system structure and dependencies of the targeted server, an attacker could potentially gain valuable information for further attacks.
Vulnerability Detail
The sanitize-html package before version 2.12.1 is susceptible to an Information Exposure vulnerability. When used on the backend with the style attribute allowed, an attacker can exploit this vulnerability to enumerate files in the system, including project dependencies. By carefully crafting HTML input, an attacker can gather details about the file system structure and dependencies of the targeted server. This information can be used to plan and execute further attacks, such as identifying vulnerable dependencies or sensitive files. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Latest published version: 2.18.1 as of 23 Oct 2026
npm install sanitize-html@2.18.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.12.1
This is the first release that contains the fix.
npm install sanitize-html@2.12.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can disable the style attribute in the sanitize-html configuration to mitigate the risk of information exposure. This can be done by setting the 'allowedAttributes' option to exclude the 'style' attribute. Here is an example of how to configure sanitize-html to disable the style attribute:
const sanitizeHtml = require('sanitize-html');
const sanitizedHtml = sanitizeHtml(dirtyHtml, {
allowedAttributes: {
'*': ['class', 'id'],
// Exclude the style attribute
'style': []
}
});
Conclusion
The sanitize-html package before version 2.12.1 is vulnerable to an Information Exposure vulnerability that allows an attacker to enumerate files in the system. It is crucial to update to version 2.12.1 or later to mitigate this vulnerability. Disabling the style attribute in the sanitize-html configuration can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sanitize-html →
FAQ
sanitize-html is an npm package used for sanitizing HTML input to prevent cross-site scripting (XSS) attacks. It provides a configurable way to remove potentially malicious code from user-generated content before rendering it in web applications.
The vulnerability allows an attacker to enumerate files in the system, including project dependencies, by exploiting the style attribute in sanitize-html. This information can be used to gather details about the file system structure and dependencies of the targeted server, potentially aiding in further attacks.
To fix this vulnerability, update the sanitize-html package to version 2.12.1 or later. This version includes a fix for the Information Exposure vulnerability. Run the command 'npm install sanitize-html@2.12.1' in your project's root directory to update the package.
Yes, as a temporary workaround, you can disable the style attribute in the sanitize-html configuration. This can be done by setting the 'allowedAttributes' option to exclude the 'style' attribute. Refer to the provided code example for more details.
The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for sanitize-html.
