Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXF4ZzUtMnFmZi1wNDly
Passing in a non-string 'html' argument can lead to unsanitized output
A type-confusion vulnerability can cause striptags
to concatenate unsanitized strings when an array-like object is passed in as the html
parameter. This can be abused by an attacker who can control the shape of their input, e.g. if query parameters are passed directly into the function.
Impact
XSS
Patches
3.2.0
Workarounds
Ensure that the html
parameter is a string before calling the function.
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXF4ZzUtMnFmZi1wNDly
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 3 years ago
Updated: over 1 year ago
CVSS Score: 3.7
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Identifiers: GHSA-qxg5-2qff-p49r, CVE-2021-32696
References:
- https://github.com/ericnorris/striptags/security/advisories/GHSA-qxg5-2qff-p49r
- https://github.com/ericnorris/striptags/commit/f252a6b0819499cd65403707ebaf5cc925f2faca
- https://github.com/ericnorris/striptags/releases/tag/v3.2.0
- https://www.npmjs.com/package/striptags
- https://nvd.nist.gov/vuln/detail/CVE-2021-32696
- https://github.com/advisories/GHSA-qxg5-2qff-p49r
Blast Radius: 16.3
Affected Packages
npm:striptags
Dependent packages: 747Dependent repositories: 25,264
Downloads: 2,758,098 last month
Affected Version Ranges: < 3.2.0
Fixed in: 3.2.0
All affected versions: 1.0.0, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 3.0.0, 3.0.1, 3.1.0, 3.1.1
All unaffected versions: 3.2.0