CVE-2017-16017 Cross-Site Scripting in sanitize-html
MediumCVSS 6.1
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
sanitize-html is a library for scrubbing html input for malicious values Versions 1.2.2 and below have a cross site scripting vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm sanitize-html(npm) | < 1.2.3 | 1.2.3 |
| punkave sanitize-html | <= 1.2.2 | No fix listed |
| HackerOne sanitize-html node module | = <=1.2.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- github.com exploit third-party-advisory
- github.com issue-tracking patch
- github.com
- www.npmjs.com
- nodesecurity.io exploit third-party-advisory
- Debian Security Tracker CVE-2017-16017 vendor-advisory