Cross-Site Scripting Vulnerability in ansi_up Package
Summary
CVE-2021-3377: The npm package ansi_up converts ANSI escape codes into HTML. Affects node-ansi-up across 2 version ranges.
< 5.0.0+dfsg-1
< c8c726ed1db979bae4f257b7fa41775155ba2e27
Fixed in 5.0.0+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ansi_up package is an npm library that converts ANSI escape codes into HTML, enabling the display of colored text in web applications. It is widely used in terminal emulators and applications that require formatted text output. The package's functionality allows developers to enhance user interfaces with visually appealing text formatting. However, a significant vulnerability has been identified in version 4 of ansi_up, which can lead to security risks if not addressed.
Vulnerability Detail
The vulnerability arises from insufficient URL sanitization in ansi_up v4, which allows ANSI escape codes to generate HTML hyperlinks. This can lead to Cross-Site Scripting (XSS) attacks, where malicious scripts can be injected into web pages viewed by users. The potential ramifications include unauthorized access to user data, session hijacking, and the execution of arbitrary scripts in the context of the user's browser. It is crucial for developers using this package to understand the risks associated with this vulnerability and take appropriate measures to mitigate them.
How To Fix
Minimum fixed version
5.0.0+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-ansi-upTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, a temporary workaround is to sanitize any user-generated content that may be processed by ansi_up before rendering it in the application. This can be done by implementing a custom sanitization function that strips out potentially harmful scripts and links from the input. For example:
function sanitizeInput(input) {
return input.replace(/<script.*?>.*?<\/script>/gi, '').replace(/<a.*?href=['"]?(.*?)['"]?[^>]*>(.*?)<\/a>/gi, '');
}
Use this function to clean any input before passing it to ansi_up.
Conclusion
The ansi_up package has a critical vulnerability that can lead to XSS attacks due to improper URL handling. It is essential for developers to upgrade to version 5.0.0 or later to mitigate this risk. In the meantime, implementing input sanitization can serve as a temporary measure to protect applications from potential exploits.
See every vulnerability recorded for node-ansi-up →
FAQ
ansi_up is an npm package that converts ANSI escape codes into HTML, allowing for colored text display in web applications.
The vulnerability is a Cross-Site Scripting (XSS) issue caused by insufficient URL sanitization in ansi_up v4.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 6.1, indicating a medium severity level.
If you cannot upgrade, implement a sanitization function to clean user input before processing it with ansi_up as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for node-ansi-up.
