npm striptags vulnerabilities

Latest npm striptags CVEs

Newest publication first

1. CVE-2021-32696 Passing in a non-string 'html' argument can lead to unsanitized output

   Published 2021-06-18

   Medium·CVSS 5.3 EPSS 1.1%

   The npm package "striptags" is an implementation of PHP's strip_tags in Typescript. In striptags before version 3.2.0, a type-confusion vulnerability can cause striptags to concatenate unsanitized strings when an array-like object is passed in as the html parameter. This can be a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.