Описание
Cross-Site Scripting in html-janitor
Versions of html-janitor prior to 2.0.2 (all current versions) are vulnerable to cross-site scripting (XSS).
This is exploitable if user-controlled data is passed into the modules clean() function.
Recommendation
No fix is currently available for this vulnerability. It is recommended to use an alternative module for HTML sanitization.
Пакеты
Наименование
html-janitor
npm
Затронутые версииВерсия исправления
< 2.0.3
2.0.3
Связанные уязвимости
CVSS3: 6.1
nvd
больше 7 лет назад
html-janitor node module suffers from a Cross-Site Scripting (XSS) vulnerability via clean() accepting user-controlled values.