Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2021-26540
5.3
MEDIUMCVSS v3
Published
February 8, 2021
CVSS v2
5 MEDIUM
Affected
1 project
Assigned by
MITRE
Severity scale
010
Description
Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with "/\\example.com".
apostrophecms/sanitize-html
GitHubClean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis. Built on htmlparser2 for speed and tolerance
GitHubClean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis. Built on htmlparser2 for speed and tolerance< 2.3.2NVD