Sanitize vulnerable to Improper Input Validation and Cross-site Scripting
High severity
GitHub Reviewed
Published
Mar 21, 2018
to the GitHub Advisory Database
•
Updated Jan 23, 2023
Description
Published to the GitHub Advisory Database
Mar 21, 2018
Published by the National Vulnerability Database
Mar 30, 2018
Reviewed
Jun 16, 2020
Last updated
Jan 23, 2023
When Sanitize <= 4.6.2 is used in combination with libxml2 >= 2.9.2, a specially crafted HTML fragment can cause libxml2 to generate improperly escaped output, allowing non-whitelisted attributes to be used on whitelisted elements.
This can allow HTML and JavaScript injection, which could result in XSS if Sanitize's output is served to browsers.
References