CVE-2023-4241: lol-html panics on certain HTML inputs

August 9, 2023

lol-html can cause panics on certain HTML inputs. Anyone processing arbitrary 3rd party HTML with the library is affected.

References

github.com/advisories/GHSA-c3x7-354f-4p2x
github.com/cloudflare/lol-html
github.com/cloudflare/lol-html/security/advisories/GHSA-c3x7-354f-4p2x
nvd.nist.gov/vuln/detail/CVE-2023-4241

Code Behaviors & Features

Detect and mitigate CVE-2023-4241 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →