debian/node-sanitize-html vulnerabilities

Latest debian/node-sanitize-html CVEs

Newest publication first

1. CVE-2024-21501 sanitize-html Information Exposure vulnerability

   Published 2024-02-24

   Medium·CVSS 5.3

   Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to...

2. CVE-2022-25887 Regular Expression Denial of Service (ReDoS)

   Published 2022-08-30

   High·CVSS 7.5

   The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.

3. CVE-2016-1000237 Cross-Site Scripting in sanitize-html

   Published 2020-01-23

   Medium·CVSS 6.1 EPSS 0.84%

   sanitize-html before 1.4.3 has XSS.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.