CVE-2021-29272: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

May 18, 2021

bluemonday before 1.0.5 allows XSS because certain Go lowercasing converts an uppercase Cyrillic character, defeating a protection mechanism against the “script” string.

References

github.com/advisories/GHSA-3x58-xr87-2fcj
github.com/microcosm-cc/bluemonday/commit/524f142fe46e945b7dcd291d7805c4b7dcf75bee
github.com/microcosm-cc/bluemonday/issues/111
github.com/microcosm-cc/bluemonday/releases/tag/v1.0.5
nvd.nist.gov/vuln/detail/CVE-2021-29272

Code Behaviors & Features

Detect and mitigate CVE-2021-29272 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →