Vulnerability · Published Feb 8, 2021 · Assigned by mitre

CVE-2021-26539

Medium 5.3

In plain English

A medium-severity security flaw in the sanitize-html package (npm). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.3Medium

Exploit odds (30 days)2.0%top 19.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	sanitize-html	2.3.1	GHSA-rjqq-98f6-6j3r

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#231-2021-01-22 x_refsource_MISC
https://github.com/apostrophecms/sanitize-html/pull/458 x_refsource_MISC
https://advisory.checkmarx.net/advisory/CX-2021-4308 x_refsource_MISC