CVE-2021-26540
CVE-2021-26540
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with "/\\example.com".
CVSS 5.3 · Medium · EPSS 1.8% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
sanitize-html npm
- Affected ranges
- SEMVER: < 2.3.2
Update to 2.3.2