CVE-2023-36823

2023-07-0616:15:10

CWE-79

GitHub_M

web.nvd.nist.gov

cve-2023-36823

sanitize

html

css

allowlist

xss

security issue

nvd

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

AI Score

5.8

Confidence

High

EPSS

0.001

Percentile

47.1%

JSON

Sanitize is an allowlist-based HTML and CSS sanitizer. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML and CSS through Sanitize starting with version 3.0.0 and prior to version 6.0.2 when Sanitize is configured to use the built-in “relaxed” config or when using a custom config that allows style elements and one or more CSS at-rules. This could result in cross-site scripting or other undesired behavior when the malicious HTML and CSS are rendered in a browser. Sanitize 6.0.2 performs additional escaping of CSS in style element content, which fixes this issue. Users who are unable to upgrade can prevent this issue by using a Sanitize config that doesn’t allow style elements, using a Sanitize config that doesn’t allow CSS at-rules, or by manually escaping the character sequence </ as <\/ in style element content.

Affected configurations

Nvd

Vulners

Node

sanitize_projectsanitizeRange3.0.0–6.0.2ruby

Node

debiandebian_linuxMatch10.0

VendorProductVersionCPE
sanitize_projectsanitize*cpe:2.3:a:sanitize_project:sanitize:*:*:*:*:*:ruby:*:*
debiandebian_linux10.0cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sanitize_project	sanitize	*	cpe:2.3:a:sanitize_project:sanitize::::::ruby::*
debian	debian_linux	10.0	cpe:2.3:o:debian:debian_linux:10.0:::::::*

CNA Affected

[
  {
    "vendor": "rgrove",
    "product": "sanitize",
    "versions": [
      {
        "version": ">= 3.0.0, < 6.0.2",
        "status": "affected"
      }
    ]
  }
]