Apostrophecms

Sanitize-html

7 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2014-125128

Exploit
  • EPSS 0.03%
  • Published 08.09.2025 10:09:25
  • Last modified 19.09.2025 15:14:35

'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS). The function 'naughtyHref' doesn't properly validate the hyperreference (`href`) attribute in anchor tags (`<a>`), allowing bypasses that contain different casings, w...

6.1

CVE-2019-25225

Exploit
  • EPSS 0.03%
  • Published 08.09.2025 10:02:42
  • Last modified 19.09.2025 15:18:42

`sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The `sanitizeHtml()` function in `index.js` does not sanitize content when using the custom `transformTags` option, which is intended to convert attribute values...

5.3

CVE-2024-21501

Exploit
  • EPSS 2.13%
  • Published 24.02.2024 05:15:44
  • Last modified 25.04.2025 19:37:25

Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could ...

7.5

CVE-2022-25887

  • EPSS 0.06%
  • Published 30.08.2022 05:15:07
  • Last modified 21.11.2024 06:53:09

The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.

5.3

CVE-2021-26539

Exploit
  • EPSS 0.29%
  • Published 08.02.2021 17:15:13
  • Last modified 21.11.2024 05:56:26

Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option.

5.3

CVE-2021-26540

Exploit
  • EPSS 0.29%
  • Published 08.02.2021 17:15:13
  • Last modified 21.11.2024 05:56:26

Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe e...

6.1

CVE-2016-1000237

  • EPSS 0.33%
  • Published 23.01.2020 15:15:13
  • Last modified 21.11.2024 02:43:01

sanitize-html before 1.4.3 has XSS.