CVE-2019-25225

sanitize-html prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The sanitizeHtml() function in index.js does not sanitize content when using the custom transformTags option, which is intended to convert attribute values into text. As a result, malicious input can be transformed into executable code.

References

Affected packages

Git / github.com/apostrophecms/sanitize-html

Affected ranges

Type

GIT

Repo

https://github.com/apostrophecms/sanitize-html

Events

Introduced

Fixed

ca28bcd95a9bfd2e1ea31bb9e7e5901f9078e875

Fixed

712cb6895825c8bb6ede71a16b42bade42abcaf3

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.0.0"
        }
    ]
}

Affected versions

1.*

1.10.1

1.11.0

1.11.1

1.11.4

1.18.2

1.18.3

1.18.4

1.18.5

1.19.0

1.19.1

1.19.2

1.19.3

1.20.0

1.21.0

1.21.1

1.22.0

1.27.4

v1.*

v1.5.2

v1.7.0

v1.7.1

v1.7.2

v1.8.0

v1.9.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-25225.json"