Lucene search
GoogleOSV:GHSA-MJXR-4V3X-Q3M4HistoryMay 06, 2021 - 4:10 p.m.
Improper Input Validation in sanitize-html
2021-05-0616:10:19
Google
osv.dev
8
apostrophe technologies
sanitize-html
input validation
hostnames
whitelist
iframe
src value
security vulnerability
EPSS
0.001
Percentile
49.3%
Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the “allowedIframeHostnames” option when the “allowIframeRelativeUrls” is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with “/\example.com”.
Related
veracode
veracode
Privilege Escalation
2021-02-09 02:21:19
redhatcve
redhatcve
CVE-2021-26540
2021-02-24 14:04:22
prion
prion
Design/Logic Flaw
2021-02-08 17:15:00
cvelist
cvelist
CVE-2021-26540
2021-02-08 16:16:07
github
github
Improper Input Validation in sanitize-html
2021-05-06 16:10:19
nvd
nvd
CVE-2021-26540
2021-02-08 17:15:13
debiancve
debiancve
CVE-2021-26540
2021-02-08 17:15:13
osv
osv
CVE-2021-26540
2021-02-08 17:15:13
cve
cve
CVE-2021-26540
2021-02-08 17:15:13
nodejs
nodejs
Improper Input Validation
2021-05-06 16:14:59
redhat
redhat