CVE-2019-25225: sanitize-html is vulnerable to XSS through incomprehensive sanitization
(updated )
sanitize-html prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The sanitizeHtml() function in index.js does not sanitize content when using the custom transformTags option, which is intended to convert attribute values into text. As a result, malicious input can be transformed into executable code.
References
- github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2019/CVE-2019-25225
- github.com/advisories/GHSA-qhxp-v273-g94h
- github.com/apostrophecms/sanitize-html
- github.com/apostrophecms/sanitize-html/commit/712cb6895825c8bb6ede71a16b42bade42abcaf3
- github.com/apostrophecms/sanitize-html/issues/293
- github.com/apostrophecms/sanitize-html/pull/156
- nvd.nist.gov/vuln/detail/CVE-2019-25225
Code Behaviors & Features
Detect and mitigate CVE-2019-25225 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →