Executive Summary

This vulnerability exists in the sanitize-html library versions prior to 2.17.4. Under the default configuration, attacker-controlled content placed inside a disallowed <xmp> HTML element can bypass the sanitizer and be turned into live HTML or JavaScript. This means that malicious code can be injected and executed despite the sanitization process.

The issue is a sanitizer bypass in the default 'disallowedTagsMode: discard' setting, which normally removes disallowed tags but fails to do so correctly for the <xmp> element.

This vulnerability can lead to stored Cross-Site Scripting (XSS) attacks in applications that render the sanitized output back to users.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow attackers to inject and execute malicious scripts in the context of users viewing the affected application. This can lead to theft of sensitive information, session hijacking, defacement, or other malicious actions performed on behalf of the user.

Because it is a stored XSS vulnerability, the malicious code can persist in the application and affect multiple users over time.

The CVSS score of 9.3 indicates a high severity impact with network attack vector, low attack complexity, no privileges required, and user interaction needed, affecting confidentiality and integrity.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade the sanitize-html package to version 2.17.4 or later, where the issue is patched.

Useful 0 Not Useful 0