CVE-2014-125128 — Cross-site Scripting in Sanitize-html

CWE-79 — Cross-site Scripting5 documents5 sources
Severity
6.1MEDIUMNVD
EPSS
0.0%
top 86.77%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Apostrophecms Sanitize-html
Timeline
PublishedSep 8

Description

'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS). The function 'naughtyHref' doesn't properly validate the hyperreference (`href`) attribute in anchor tags (``), allowing bypasses that contain different casings, whitespace characters, or hexadecimal encodings.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages1 packages

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-389w-f784-rjg3: 'sanitize-html' prior to version 1↗2025-09-08
▶
CVEList
CVE-2014-125128: 'sanitize-html' prior to version 1↗2025-09-08
▶
OSV
CVE-2014-125128: 'sanitize-html' prior to version 1↗2025-09-08
▶

📋Vendor Advisories

1
Debian
CVE-2014-125128: node-sanitize-html - 'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XS...↗2014
▶
CVE-2014-125128 — Cross-site Scripting in Sanitize-html | cvebase