CVE-2021-29272: Cross-site scripting in bluemonday
Summary
CVE-2021-29272: Cross-site scripting in github.com/microcosm-cc/bluemonday. Affects github.com/microcosm-cc/bluemonday versions < 1.0.5. Fixed in 1.0.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is bluemonday, a Go library that provides a HTML sanitizer. It is commonly used to prevent cross-site scripting (XSS) attacks by sanitizing user-generated HTML input. The library is designed to parse and clean HTML, removing any potentially malicious code. However, bluemonday versions prior to 1.0.5 are vulnerable to a specific type of XSS attack due to a lowercase conversion of an uppercase Cyrillic character, which bypasses the protection mechanism against the "script" string.
Vulnerability Detail
The vulnerability in bluemonday allows an attacker to inject malicious scripts into web pages, potentially leading to the execution of arbitrary code in the context of the victim's browser. By exploiting this vulnerability, an attacker can steal sensitive information, perform actions on behalf of the victim, or manipulate the content of the web page. The vulnerability is rated as moderate with a CVSS score of 6.1. It is classified under CWE-79, which is the Common Weakness Enumeration category for Cross-Site Scripting (XSS) vulnerabilities.
How To Fix
Minimum fixed version
1.0.5
This is the first release that contains the fix.
go get github.com/microcosm-cc/bluemonday@v1.0.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of bluemonday to mitigate the risk of XSS attacks.
Conclusion
In conclusion, bluemonday versions prior to 1.0.5 are vulnerable to a cross-site scripting (XSS) attack. It is crucial for developers to upgrade to the fixed version to protect their applications from potential exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/microcosm-cc/bluemonday →
FAQ
bluemonday is a Go library used for HTML sanitization to prevent cross-site scripting (XSS) attacks.
The vulnerability allows an attacker to inject malicious scripts into web pages, potentially leading to the execution of arbitrary code in the victim's browser.
To fix the vulnerability, you should upgrade bluemonday to version 1.0.5 or later.
No, there is no known workaround. Upgrading to the fixed version is the recommended solution.
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/microcosm-cc/bluemonday.
