Lucene search
AnonymousNODEJS:1675HistoryMay 06, 2021 - 4:14 p.m.
Improper Input Validation
2021-05-0616:14:51
Anonymous
www.npmjs.com
18
security
input validation
sanitize-html
internationalized domain name
cve-2021-26539
github advisory
EPSS
0.001
Percentile
49.3%
Overview
sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the “allowedIframeHostnames” option.
Recommendation
Upgrade to version 2.3.1 or later
References
Related
veracode
veracode
Hostname Validation Bypass
2021-02-09 02:31:31
prion
prion
Design/Logic Flaw
2021-02-08 17:15:00
osv
osv
CVE-2021-26539
2021-02-08 17:15:13
Improper Input Validation in sanitize-html
2021-05-06 16:10:05
debiancve
debiancve
CVE-2021-26539
2021-02-08 17:15:13
redhatcve
redhatcve
CVE-2021-26539
2021-02-24 14:04:11
nvd
nvd
CVE-2021-26539
2021-02-08 17:15:13
cvelist
cvelist
CVE-2021-26539
2021-02-08 16:16:06
cve
cve
CVE-2021-26539
2021-02-08 17:15:13
github
github
Improper Input Validation in sanitize-html
2021-05-06 16:10:05
redhat
redhat