Miggo Logo

CVE-2021-26540: Improper Input Validation in sanitize-html

5.3

CVSS Score
3.1

Basic Information

EPSS Score
0.51974%
Published
5/6/2021
Updated
2/1/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
sanitize-htmlnpm< 2.3.22.3.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability exists in the core sanitizeHtml function's handling of iframe src attributes. The patch adds validation logic directly in this function to address improper input validation of protocol-relative URLs containing backslashes and whitespace. The function signature matches the main export of the package, and the evidence shows direct modification to the attribute processing path for iframe elements. The tests demonstrate exploitation occurs through this code path when processing malicious src values.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*postrop** T***nolo*i*s s*nitiz*-*tml ***or* *.*.* *o*s not prop*rly v*li**t* t** *ostn*m*s s*t *y t** "*llow**I*r*m**ostn*m*s" option w**n t** "*llowI*r*m*R*l*tiv*Urls" is s*t to tru*, w*i** *llows *tt**k*rs to *yp*ss *ostn*m* w*it*list *or i*r*m* *

Reasoning

T** vuln*r**ility *xists in t** *or* s*nitiz**tml *un*tion's **n*lin* o* i*r*m* sr* *ttri*ut*s. T** p*t** ***s v*li**tion lo*i* *ir**tly in t*is *un*tion to ***r*ss improp*r input v*li**tion o* proto*ol-r*l*tiv* URLs *ont*inin* ***ksl*s**s *n* w*it*s