Information Exposure Vulnerability in node-sanitize-html Package
Summary
UBUNTU-CVE-2024-21501: Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dep... Affects node-sanitize-html versions 2.6.1-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The node-sanitize-html package is a popular library used in Node.js applications to sanitize HTML content, ensuring that only safe HTML is rendered. This package is widely utilized for web applications that allow user-generated content, providing a layer of security against XSS (Cross-Site Scripting) attacks. However, certain versions of this package are vulnerable to information exposure, particularly when the style attribute is permitted.
Vulnerability Detail
Versions of the node-sanitize-html package prior to 2.12.1 are susceptible to an Information Exposure vulnerability. This issue arises when the package is used on the backend with the style attribute allowed, enabling attackers to enumerate files within the system, including project dependencies. The vulnerability could lead to unauthorized access to sensitive information about the file system structure and dependencies of the targeted server, potentially aiding attackers in further exploits.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can disable the use of the style attribute in your application until the package is updated. This can be done by configuring the sanitizer options to disallow styles. For example:
const sanitizeHtml = require('sanitize-html');
const cleanHtml = sanitizeHtml(dirtyHtml, { allowedStyles: {} });
Conclusion
The node-sanitize-html package has a significant vulnerability that can lead to information exposure if not addressed. It is crucial for developers to update to the latest versions to mitigate this risk. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for node-sanitize-html →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a medium severity level.
Versions prior to 2.12.1 of the node-sanitize-html package are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability could allow attackers to gather sensitive information about the file system structure and dependencies, potentially leading to further attacks.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for node-sanitize-html.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
