Vulnerability · Published Jan 4, 2021 · Assigned by GitHub_M
CVE-2020-26293Possible XSS bypass if style tag is allowed
Medium 6.1
In plain English
A medium-severity injection in HtmlSanitizer from mganss. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. In HtmlSanitizer before version 5.0.372, there is a possible XSS bypass if style tag is allowed. If you have explicitly allowed the `<style>` tag, an attacker could craft HTML that includes script after passing through the sanitizer. The default settings disallow the `<style>` tag so there is no risk if you have not explicitly allowed the `<style>` tag. The problem has been fixed in version 5.0.372.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| NuGet | htmlsanitizer | 5.0.372 | GHSA-8j9v-h2vp-2hhv |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| mganss | HtmlSanitizer | < 5.0.372 |
Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N
References
- https://github.com/mganss/HtmlSanitizer/security/advisories/GHSA-8j9v-h2vp-2hhv x_refsource_CONFIRM
- https://www.nuget.org/packages/HtmlSanitizer/ x_refsource_MISC
- https://github.com/mganss/HtmlSanitizer/releases/tag/v5.0.372 x_refsource_MISC
- https://github.com/mganss/HtmlSanitizer/commit/a3a7602a44d4155d51ec0fbbedc2a49e9c7e2eb8 x_refsource_MISC