CVE-2021-26539
CVE-2021-26539
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option.
CVSS 5.3 · Medium · EPSS 2.0% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
sanitize-html npm
- Affected ranges
- SEMVER: < 2.3.1
Update to 2.3.1