Lucene search
GoogleOSV:GHSA-RJQQ-98F6-6J3RHistoryMay 06, 2021 - 4:10 p.m.
Improper Input Validation in sanitize-html
2021-05-0616:10:05
Google
osv.dev
8
apostrophe technologies
sanitize-html
input validation
hostname whitelist
idn
attacker
software security
EPSS
0.001
Percentile
49.3%
Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the “allowedIframeHostnames” option.
References
advisory.checkmarx.net/advisory/CX-2021-4308
github.com/apostrophecms/sanitize-html
github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#231-2021-01-22
github.com/apostrophecms/sanitize-html/commit/bdf7836ef8f0e5b21f9a1aab0623ae8fcd09c1da
github.com/apostrophecms/sanitize-html/pull/458
nvd.nist.gov/vuln/detail/CVE-2021-26539
Related
nodejs
nodejs
Improper Input Validation
2021-05-06 16:14:51
veracode
veracode
Hostname Validation Bypass
2021-02-09 02:31:31
prion
prion
Design/Logic Flaw
2021-02-08 17:15:00
osv
osv
CVE-2021-26539
2021-02-08 17:15:13
debiancve
debiancve
CVE-2021-26539
2021-02-08 17:15:13
redhatcve
redhatcve
CVE-2021-26539
2021-02-24 14:04:11
nvd
nvd
CVE-2021-26539
2021-02-08 17:15:13
cvelist
cvelist
CVE-2021-26539
2021-02-08 16:16:06
cve
cve
CVE-2021-26539
2021-02-08 17:15:13
github
github
Improper Input Validation in sanitize-html
2021-05-06 16:10:05
redhat
redhat