REDHAT-BUG-1936427: XSS
The npm package ansiup converts ANSI escape codes into HTML. In ansiup v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, this feature is affected by a cross-site scripting (XSS) vulnerability. This issue is fixed in v5.0.0.
Reference: https://doyensec.com/resources/DoyensecAdvisoryansiup4XSS.pdf
Upstream patch: https://github.com/drudru/ansiup/commit/c8c726ed1db979bae4f257b7fa41775155ba2e27
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1936427?
The severity of REDHAT-BUG-1936427 is classified as critical due to its potential for cross-site scripting (XSS).
How do I fix REDHAT-BUG-1936427?
To fix REDHAT-BUG-1936427, update the ansi_up npm package to version 5.0.0 or later.
What versions of ansi_up are affected by REDHAT-BUG-1936427?
Versions of ansi_up prior to 5.0.0 are affected by REDHAT-BUG-1936427.
What type of vulnerability is REDHAT-BUG-1936427?
REDHAT-BUG-1936427 is a cross-site scripting (XSS) vulnerability related to URL sanitization.
What feature in ansi_up v4 is linked to REDHAT-BUG-1936427?
The feature that allows ANSI escape codes to create HTML hyperlinks is linked to REDHAT-BUG-1936427.