CVE-2017-16016: XSS
Affected versions of sanitize-html are vulnerable to cross-site scripting when allowedTags includes at least one nonTextTag.
Proof of Concept
js var sanitizeHtml = require('sanitize-html');
var dirty = '!<textarea></textarea><svg/onload=promptxs></textarea>!'; var clean = sanitizeHtml(dirty, { allowedTags: [ 'textarea' ] });
console.log(clean);
// !<textarea></textarea><svg/onload=promptxs></textarea>!
Recommendation
Update to version 1.11.4 or later.
Other sources
Sanitize-html is a library for scrubbing html input of malicious values. Versions 1.11.1 and below are vulnerable to cross site scripting (XSS) in certain scenarios: If allowed at least one nonTextTags, the result is a potential XSS vulnerability.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-16016?
CVE-2017-16016 is classified as a high severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2017-16016?
To fix CVE-2017-16016, update the 'sanitize-html' package to version 1.11.2 or later.
What are the affected versions of CVE-2017-16016?
CVE-2017-16016 affects versions of 'sanitize-html' up to and including 1.11.1.
What types of attacks can CVE-2017-16016 lead to?
CVE-2017-16016 can lead to cross-site scripting (XSS) attacks if user input is not properly sanitized.
Are there any workarounds for CVE-2017-16016?
A workaround for CVE-2017-16016 is to avoid using non-text tags in the allowedTags configuration within the 'sanitize-html' library.