CVE-2014-125128: XSS
'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS). The function 'naughtyHref' doesn't properly validate the hyperreference (href) attribute in anchor tags (<a>), allowing bypasses that contain different casings, whitespace characters, or hexadecimal encodings.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-125128?
CVE-2014-125128 is classified as a moderate severity vulnerability due to its potential to allow Cross-site Scripting (XSS) attacks.
How do I fix CVE-2014-125128?
To fix CVE-2014-125128, upgrade sanitize-html to version 1.0.3 or later, where the vulnerability is addressed.
What types of attacks can exploit CVE-2014-125128?
CVE-2014-125128 can be exploited to perform Cross-site Scripting (XSS) attacks by injecting malicious scripts through improperly sanitized hyperreference attributes.
Which versions of sanitize-html are affected by CVE-2014-125128?
Versions of sanitize-html prior to 1.0.3 are affected by CVE-2014-125128 and are vulnerable to XSS.
What is the root cause of CVE-2014-125128?
The root cause of CVE-2014-125128 is the inadequate validation of the hyperreference (`href`) attribute in anchor tags, especially regarding different casing, whitespace, and hexadecimal encoding.