CVE-2017-16016 Cross-Site Scripting in sanitize-html
MediumCVSS 6.1
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Sanitize-html is a library for scrubbing html input of malicious values. Versions 1.11.1 and below are vulnerable to cross site scripting (XSS) in certain scenarios: If allowed at least one nonTextTags, the result is a potential XSS vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm sanitize-html(npm) | <= 1.11.1 | No fix listed |
| punkave sanitize-html | <= 1.11.1 | No fix listed |
| HackerOne sanitize-html node module | = <=1.11.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- github.com exploit issue-tracking third-party-advisory
- github.com patch
- github.com
- npmjs.com
- www.npmjs.com
- github.com patch
- nodesecurity.io exploit third-party-advisory
- Debian Security Tracker CVE-2017-16016 vendor-advisory