Apostrophecms

Sanitize-html

7 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2014-125128

Exploit
  • EPSS 0.03%
  • Veröffentlicht 08.09.2025 10:09:25
  • Zuletzt bearbeitet 19.09.2025 15:14:35

'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS). The function 'naughtyHref' doesn't properly validate the hyperreference (`href`) attribute in anchor tags (`<a>`), allowing bypasses that contain different casings, w...

6.1

CVE-2019-25225

Exploit
  • EPSS 0.03%
  • Veröffentlicht 08.09.2025 10:02:42
  • Zuletzt bearbeitet 19.09.2025 15:18:42

`sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The `sanitizeHtml()` function in `index.js` does not sanitize content when using the custom `transformTags` option, which is intended to convert attribute values...

5.3

CVE-2024-21501

Exploit
  • EPSS 2.13%
  • Veröffentlicht 24.02.2024 05:15:44
  • Zuletzt bearbeitet 25.04.2025 19:37:25

Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could ...

7.5

CVE-2022-25887

  • EPSS 0.06%
  • Veröffentlicht 30.08.2022 05:15:07
  • Zuletzt bearbeitet 21.11.2024 06:53:09

The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.

5.3

CVE-2021-26539

Exploit
  • EPSS 0.29%
  • Veröffentlicht 08.02.2021 17:15:13
  • Zuletzt bearbeitet 21.11.2024 05:56:26

Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option.

5.3

CVE-2021-26540

Exploit
  • EPSS 0.29%
  • Veröffentlicht 08.02.2021 17:15:13
  • Zuletzt bearbeitet 21.11.2024 05:56:26

Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe e...

6.1

CVE-2016-1000237

  • EPSS 0.33%
  • Veröffentlicht 23.01.2020 15:15:13
  • Zuletzt bearbeitet 21.11.2024 02:43:01

sanitize-html before 1.4.3 has XSS.