MEDIUM5.4
GHSA-hqq7-2q2v-82xq
Cross-site Scripting in sanitize-url
Quick fix
GHSA-hqq7-2q2v-82xq — @braintree/sanitize-url: upgrade to the fixed version with the command below.
npm install @braintree/sanitize-url@6.0.0Details
The package `@braintree/sanitize-url` before 6.0.0 is vulnerable to Cross-site Scripting (XSS) due to improper sanitization in the `sanitizeUrl` function.
Are you affected?
Enter the version of the package you're using.
Affected packages
npm/@braintree/sanitize-url
Introduced in:
0Fixed in: 6.0.0Fix
npm install @braintree/sanitize-url@6.0.0References
- https://nvd.nist.gov/vuln/detail/CVE-2021-23648[ADVISORY]
- https://github.com/braintree/sanitize-url/pull/40[WEB]
- https://github.com/braintree/sanitize-url/pull/40/commits/e5afda45d9833682b705f73fc2c1265d34832183[WEB]
- https://github.com/braintree/sanitize-url[PACKAGE]
- https://github.com/braintree/sanitize-url/blob/main/src/index.ts%23L11[WEB]
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D[WEB]
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH[WEB]
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ[WEB]
- https://snyk.io/vuln/SNYK-JS-BRAINTREESANITIZEURL-2339882[WEB]