Skip to content
OpenAdvisories

Package · Ubuntu

node-sanitize-html

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Medium 6.1
    CVE-2014-125128

    'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS). The function 'naughtyHref' doesn't …

    node-sanitize-html Ubuntu
  • Medium 6.1
    CVE-2019-25225

    sanitize-html is vulnerable to XSS through incomprehensive sanitization

    `sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The `sanitizeHtml()` function in `index.js` does not sanitize content when using the custom `transformTags` option, which is intended to convert attribute values into tex…

    sanitize-html node-sanitize-html Ubuntu npm
  • Medium 5.3
    CVE-2024-21501

    sanitize-html Information Exposure vulnerability

    Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit t…

    sanitize-html node-sanitize-html node-sanitize-html Debian Ubuntu npm
  • Medium 5.3
    CVE-2022-25887

    Regular Expression Denial of Service (ReDoS)

    The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.

    sanitize-html jupyter-notebook node-sanitize-html node-sanitize-html Debian Ubuntu npm