Skip to content

Passing in a non-string 'html' argument can lead to unsanitized output

Moderate severity GitHub Reviewed Published Jun 18, 2021 in ericnorris/striptags • Updated Feb 1, 2023

Package

npm striptags (npm)

Affected versions

< 3.2.0

Patched versions

3.2.0

Description

A type-confusion vulnerability can cause striptags to concatenate unsanitized strings when an array-like object is passed in as the html parameter. This can be abused by an attacker who can control the shape of their input, e.g. if query parameters are passed directly into the function.

Impact

XSS

Patches

3.2.0

Workarounds

Ensure that the html parameter is a string before calling the function.

References

@ericnorris ericnorris published to ericnorris/striptags Jun 18, 2021
Reviewed Jun 18, 2021
Published to the GitHub Advisory Database Jun 18, 2021
Published by the National Vulnerability Database Jun 18, 2021
Last updated Feb 1, 2023

Severity

Moderate

EPSS score

Exploit Prediction Scoring System (EPSS)

This score estimates the probability of this vulnerability being exploited within the next 30 days. Data provided by FIRST.
(52nd percentile)

Weaknesses

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Learn more on MITRE.

Improper Handling of Unexpected Data Type

The product does not handle or incorrectly handles when a particular element is not the expected type, e.g. it expects a digit (0-9) but is provided with a letter (A-Z). Learn more on MITRE.

Access of Resource Using Incompatible Type ('Type Confusion')

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type. Learn more on MITRE.

CVE ID

CVE-2021-32696

GHSA ID

GHSA-qxg5-2qff-p49r

Source code

No known source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.