MEDIUM6.1

GHSA-fx46-whrj-73v5

Bypassing Sanitization using DOM clobbering in html-janitor

Details

All versions of `html-janitor` are vulnerable to cross-site scripting (XSS).

Arbitrary HTML can pass the sanitization process, which can be unexpected and dangerous (XSS) in case user-controlled input is passed to the clean function."

## Recommendation

Upgrade to version 2.0.4 or later.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/html-janitor

Introduced in: 0

No fixed version published yet for html-janitor (npm). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2017-0928[ADVISORY]
https://github.com/guardian/html-janitor/issues/35[WEB]
https://hackerone.com/reports/308158[WEB]
https://github.com/advisories/GHSA-fx46-whrj-73v5[ADVISORY]
https://www.npmjs.com/advisories/569[WEB]