GHSA-5p28-63mc-cgr9

    Dashboard / Vulnerabilities / GHSA-5p28-63mc-cgr9

    GHSA-5p28-63mc-cgr9

    Published: 4 Dec 2020Last Modified: 4 Dec 2020

    Summary: Cross-Site Scripting bypass in html-purify

    Details: All versions of html-purify are vulnerable to cross-site scripting. The data attribute inside of object tags is not properly sanitized and allows javascript URIs leading to code execution. No fix is currently available. Consider using an alternative package until a fix is made available.

    References: https://www.npmjs.com/advisories/1586

    Affected packages

    Package

    Name: html-purify

    Purl: pkg:npm/html-purify

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-5p28-63mc-cgr9 | CVE-DB