Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-x4cs-g2jz-eqb5
Vulnerability ID VCID-x4cs-g2jz-eqb5
Aliases CVE-2021-23648
GHSA-hqq7-2q2v-82xq
Summary Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') The package @braintree/sanitize-url before 6.0.0 is vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 5.4 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-23648.json
epss 0.00116 https://api.first.org/data/v1/epss?cve=CVE-2021-23648
epss 0.00116 https://api.first.org/data/v1/epss?cve=CVE-2021-23648
epss 0.00116 https://api.first.org/data/v1/epss?cve=CVE-2021-23648
epss 0.00116 https://api.first.org/data/v1/epss?cve=CVE-2021-23648
epss 0.00116 https://api.first.org/data/v1/epss?cve=CVE-2021-23648
epss 0.00116 https://api.first.org/data/v1/epss?cve=CVE-2021-23648
epss 0.00116 https://api.first.org/data/v1/epss?cve=CVE-2021-23648
epss 0.00116 https://api.first.org/data/v1/epss?cve=CVE-2021-23648
epss 0.00116 https://api.first.org/data/v1/epss?cve=CVE-2021-23648
epss 0.00116 https://api.first.org/data/v1/epss?cve=CVE-2021-23648
epss 0.00116 https://api.first.org/data/v1/epss?cve=CVE-2021-23648
epss 0.00126 https://api.first.org/data/v1/epss?cve=CVE-2021-23648
epss 0.00126 https://api.first.org/data/v1/epss?cve=CVE-2021-23648
epss 0.00126 https://api.first.org/data/v1/epss?cve=CVE-2021-23648
epss 0.00126 https://api.first.org/data/v1/epss?cve=CVE-2021-23648
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-hqq7-2q2v-82xq
cvssv3.1 5.4 https://github.com/braintree/sanitize-url
generic_textual MODERATE https://github.com/braintree/sanitize-url
cvssv3.1 5.4 https://github.com/braintree/sanitize-url/blob/main/src/index.ts%23L11
generic_textual MODERATE https://github.com/braintree/sanitize-url/blob/main/src/index.ts%23L11
cvssv3.1 5.4 https://github.com/braintree/sanitize-url/pull/40
generic_textual MODERATE https://github.com/braintree/sanitize-url/pull/40
cvssv3.1 5.4 https://github.com/braintree/sanitize-url/pull/40/commits/e5afda45d9833682b705f73fc2c1265d34832183
generic_textual MODERATE https://github.com/braintree/sanitize-url/pull/40/commits/e5afda45d9833682b705f73fc2c1265d34832183
cvssv3.1 5.4 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D
generic_textual MODERATE https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D
cvssv3.1 5.4 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH
generic_textual MODERATE https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH
cvssv3.1 5.4 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ
generic_textual MODERATE https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ
cvssv3.1 5.4 https://nvd.nist.gov/vuln/detail/CVE-2021-23648
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2021-23648
cvssv3.1 5.4 https://snyk.io/vuln/SNYK-JS-BRAINTREESANITIZEURL-2339882
generic_textual MODERATE https://snyk.io/vuln/SNYK-JS-BRAINTREESANITIZEURL-2339882
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-23648.json
https://api.first.org/data/v1/epss?cve=CVE-2021-23648
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23648
https://github.com/braintree/sanitize-url
https://github.com/braintree/sanitize-url/blob/main/src/index.ts%23L11
https://github.com/braintree/sanitize-url/pull/40
https://github.com/braintree/sanitize-url/pull/40/commits/e5afda45d9833682b705f73fc2c1265d34832183
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ/
https://snyk.io/vuln/SNYK-JS-BRAINTREESANITIZEURL-2339882
2065290 https://bugzilla.redhat.com/show_bug.cgi?id=2065290
CVE-2021-23648 https://nvd.nist.gov/vuln/detail/CVE-2021-23648
GHSA-hqq7-2q2v-82xq https://github.com/advisories/GHSA-hqq7-2q2v-82xq
RHSA-2022:5069 https://access.redhat.com/errata/RHSA-2022:5069
RHSA-2022:7519 https://access.redhat.com/errata/RHSA-2022:7519
RHSA-2022:8057 https://access.redhat.com/errata/RHSA-2022:8057
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-23648.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://github.com/braintree/sanitize-url
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://github.com/braintree/sanitize-url/blob/main/src/index.ts%23L11
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://github.com/braintree/sanitize-url/pull/40
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://github.com/braintree/sanitize-url/pull/40/commits/e5afda45d9833682b705f73fc2c1265d34832183
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-23648
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://snyk.io/vuln/SNYK-JS-BRAINTREESANITIZEURL-2339882
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.30412
EPSS Score 0.00116
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:49:42.579217+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/@braintree/sanitize-url/CVE-2021-23648.yml 38.0.0