CVE-2021-26540 Improper Input Validation in sanitize-html
Attackers can bypass iframe hostname whitelists in sanitize-html when relative URLs are allowed, enabling unauthorized content embedding.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-26540?
CVE-2021-26540 is a medium-severity vulnerability in n/a, published on 8 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with "/\\example.com".
Which versions are affected by CVE-2021-26540?
2 open source packages ship an affected version, including sanitize-html. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
sanitize-html npm | All versions | 2.3.2 |
sanitize-html npm | All versions | 2.3.2 |
Products include Apostrophecms Sanitize-Html.
How do I fix CVE-2021-26540?
Upgrade sanitize-html to 2.3.2 or later.
Is CVE-2021-26540 being exploited?
There is no known exploitation of CVE-2021-26540 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2014-125128 Cross-site scripting in apostrophecms:sanitize-html
- CVE-2019-25225 sanitize-html is vulnerable to XSS through incomprehensive sanitization
- CVE-2016-1000237 Cross-Site Scripting in sanitize-html
- CVE-2024-21501 sanitize-html Information Exposure vulnerability
- CVE-2022-25887 Regular Expression Denial of Service (ReDoS)
Sources
Also known as GHSA-mjxr-4v3x-q3m4, ROOT-APP-NPM-CVE-2021-26540.