CVE-2021-26540: Input Validation
Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with "/\\example.com".
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-26540?
CVE-2021-26540 is a vulnerability in Apostrophe Technologies sanitize-html before 2.3.2 that allows attackers to bypass hostname whitelisting for iframe elements.
What is the severity of CVE-2021-26540?
The severity of CVE-2021-26540 is medium with a CVSS score of 5.3.
How does CVE-2021-26540 work?
CVE-2021-26540 allows attackers to bypass hostname whitelist by setting hostnames through the "allowedIframeHostnames" option when "allowIframeRelativeUrls" is set to true.
What software is affected by CVE-2021-26540?
Apostrophecms sanitize-html versions before 2.3.2 are affected by CVE-2021-26540.
How can CVE-2021-26540 be fixed?
To fix CVE-2021-26540, update Apostrophecms sanitize-html to version 2.3.2 or later.