CVE-2021-26539 Improper Input Validation in sanitize-html
An attacker can bypass iframe hostname whitelisting in sanitize-html by exploiting internationalized domain name handling flaws.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-26539?
CVE-2021-26539 is a medium-severity vulnerability in n/a, published on 8 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option.
Which versions are affected by CVE-2021-26539?
2 open source packages ship an affected version, including sanitize-html. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
sanitize-html npm | All versions | 2.3.1 |
sanitize-html npm | All versions | 2.3.1 |
Products include Apostrophecms Sanitize-Html.
How do I fix CVE-2021-26539?
Upgrade sanitize-html to 2.3.1 or later.
Is CVE-2021-26539 being exploited?
There is no known exploitation of CVE-2021-26539 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2014-125128 Cross-site scripting in apostrophecms:sanitize-html
- CVE-2019-25225 sanitize-html is vulnerable to XSS through incomprehensive sanitization
- CVE-2016-1000237 Cross-Site Scripting in sanitize-html
- CVE-2024-21501 sanitize-html Information Exposure vulnerability
- CVE-2022-25887 Regular Expression Denial of Service (ReDoS)
Sources
Also known as GHSA-rjqq-98f6-6j3r, ROOT-APP-NPM-CVE-2021-26539.