Description
The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | @braintree/sanitize-url | unspecified – < 6.0.0 | 6.0.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-mermaid | 8.14.0+~cs11.4.14-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-mermaid | No fix yet | — |
| Ubuntu 22.04 LTS | node-mermaid | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | grafana | 7.5.15-3.el9 | RHSA-2022:8057 |
| RHEL 8 | grafana | 7.5.15-3.el8 | RHSA-2022:7519 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | grafana | 7.5.15-3.el9 | ALSA-2022:8057 |
| AlmaLinux 8 | grafana | 7.5.15-3.el8 | ALSA-2022:7519 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | grafana | 7.5.15-3.el9 | RLSA-2022:8057 |
| Rocky Linux 8 | grafana | 7.5.15-3.el8 | RLSA-2022:7519 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | grafana | 7.5.15-3.el9 | ELSA-2022-8057 |
| Oracle Linux 8 | grafana | 7.5.15-3.el8 | ELSA-2022-7519 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @braintree/sanitize-url | < 6.0.0 | 6.0.0 | GHSA-hqq7-2q2v-82xq |
Advisories 8
- ALSA-2022:8057 Important: grafana security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2022:7519 Moderate: grafana security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2022:8057 Red Hat Security Advisory: grafana security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2022:7519 Red Hat Security Advisory: grafana security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RLSA-2022:8057 Important: grafana security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 5, 2026
- RLSA-2022:7519 Moderate: grafana security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 5, 2026
- ELSA-2022-8057 Important: grafana security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 22, 2022
- ELSA-2022-7519 Moderate: grafana security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 15, 2022
References
- https://snyk.io/vuln/SNYK-JS-BRAINTREESANITIZEURL-2339882
- https://github.com/braintree/sanitize-url/blob/main/src/index.ts%23L11
- https://github.com/braintree/sanitize-url/pull/40
- https://github.com/braintree/sanitize-url/pull/40/commits/e5afda45d9833682b705f73fc2c1265d34832183
- FEDORA-2022-83405f9d5b vendor-advisory
- FEDORA-2022-9dd03cab55 vendor-advisory
- FEDORA-2022-c5383675d9 vendor-advisory