Staging Environment: Content and features may be unstable or change without notice.

Advisory Weakness Curation

CVE-2021-26540

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-mjxr-4v3x-q3m4

Improper Input Validation in sanitize-html Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with "/\\example.com".

gitlab/npm/sanitize-html/CVE-2021-26540

Origin Validation Error sanitize-html does not properly validate the hostnames set by the `allowedIframeHostnames` option when the `allowIframeRelativeUrls` is set to true, which allows attackers to bypass the hostname allow list for an iframe element.