CVE-2017-16016
Sanitize-html is a library for scrubbing html input of malicious values. Versions 1.11.1 and below are vulnerable to cross site scripting (XSS) in certain scenarios: If allowed at least one nonTextTags, the result is a potential XSS vulnerability.
| Software | From | Fixed in |
|---|---|---|
| punkave / sanitize-html | - | 1.11.1.x |
sanitize-html
|
- | 1.11.4 |
- https://github.com/punkave/sanitize-html/commit/5d205a1005ba0df80e21d8c64a15bb3accdb2403
- https://github.com/punkave/sanitize-html/commit/5d205a1005ba0df80e21d8c64a15bb3accdb2403)))
- https://github.com/punkave/sanitize-html/issues/100
- https://nodesecurity.io/advisories/154
- https://npmjs.com/package/sanitize-html#discarding-the-entire-contents-of-a-disallowed-tag
- https://www.npmjs.com/advisories/154
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime