REDHAT-BUG-2488565: XSS
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of sanitize-html prior to 2.17.4 can turn attacker-controlled content inside a disallowed xmp element into live HTML or JavaScript. This is a sanitizer bypass in the default disallowedTagsMode: 'discard' path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
sanitize-htmlto a version that resolves this vulnerability.Fixed in 2.17.4
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2488565?
The severity of REDHAT-BUG-2488565 is classified as high, with a score of 7.
How do I fix REDHAT-BUG-2488565?
To fix REDHAT-BUG-2488565, update the sanitize-html package to version 2.17.4 or later.
What type of vulnerability is identified in REDHAT-BUG-2488565?
REDHAT-BUG-2488565 identifies a Cross-Site Scripting (XSS) vulnerability.
What software is affected by REDHAT-BUG-2488565?
The affected software for REDHAT-BUG-2488565 is npm/sanitize-html.
What are the risks associated with REDHAT-BUG-2488565?
The risks associated with REDHAT-BUG-2488565 include the potential for an attacker to execute malicious scripts through improperly handled HTML content.