—

GO-2022-0762

Cross-site scripting due to incorrect sanitization in github.com/microcosm-cc/bluemonday

Quick fix

GO-2022-0762 — github.com/microcosm-cc/bluemonday: upgrade to the fixed version with the command below.

go get github.com/microcosm-cc/bluemonday@v1.0.5

Details

An XSS injection was possible because the sanitization of the Cyrillic character i bypass a protection mechanism against user-inputted HTML elements such as the <script> tag.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/microcosm-cc/bluemonday

Introduced in: 0Fixed in: 1.0.5

Fixgo get github.com/microcosm-cc/bluemonday@v1.0.5

References

https://github.com/microcosm-cc/bluemonday/commit/524f142fe46e945b7dcd291d7805c4b7dcf75bee[FIX]
https://github.com/microcosm-cc/bluemonday/issues/111[WEB]
https://github.com/microcosm-cc/bluemonday/releases/tag/v1.0.5[WEB]