CVE-2024-21501
CVE-2024-21501
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.
CVSS 5.3 · Medium · EPSS 1.0% · Fix available
- Published
- Updated
Affected products and versions
sanitize-html
- Versions
- ≥ 0, < 2.12.1: Affected (semver)
Update to 2.12.1
org.webjars.npm:sanitize-html
- Versions
- ≥ 0: Affected (semver)
No fix published
node-sanitize-html Debian:12
- Versions
- 2.13.0+~2.11.0-1
- 2.13.1+~2.13.0-1
- 2.14.0+~2.13.0-1
- 2.17.0+~2.16.1-1
- 2.8.0+~2.6.2-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-sanitize-html Debian:13
- Affected ranges
- ECOSYSTEM: < 2.13.0+~2.11.0-1
Update to 2.13.0+~2.11.0-1
node-sanitize-html Debian:14
- Affected ranges
- ECOSYSTEM: < 2.13.0+~2.11.0-1
Update to 2.13.0+~2.11.0-1
sanitize-html npm
- Affected ranges
- SEMVER: < 2.12.1
Update to 2.12.1
node-sanitize-html Ubuntu:22.04:LTS
- Versions
- 2.6.1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-sanitize-html Ubuntu:24.04:LTS
- Versions
- 2.8.0+~2.6.2-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-sanitize-html Ubuntu:25.10
- Versions
- 2.14.0+~2.13.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-sanitize-html Ubuntu:26.10
- Versions
- 2.14.0+~2.13.0-1
- 2.17.0+~2.16.1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-sanitize-html Ubuntu:26.04:LTS
- Versions
- 2.14.0+~2.13.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-6256334
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6276557
- https://gist.github.com/Slonser/8b4d061abe6ee1b2e10c7242987674cf
- https://github.com/apostrophecms/sanitize-html/pull/650
- https://github.com/apostrophecms/apostrophe/discussions/4436
- https://github.com/apostrophecms/sanitize-html/commit/c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4
- https://lists.fedoraproject.org/archives/list/[email protected]/message/P4I5X6V3LYUNBMZ5YOW4BV427TH3IK4S/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/4EB5JPYRCTS64EA5AMV3INHDPI6I4AW7/
- https://nvd.nist.gov/vuln/detail/CVE-2024-21501