CVE-2021-26540

published 2021-02-08

CVE-2021-26540: Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the…

Priority P4 29 medium 5.3 CVSS 3.1

AV N AC L PR N UI N S U C N I L A N

Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with "/\\example.com".

Affected

3 ranges

Vendor	Product	Version range	Fixed in
apostrophecms	sanitize-html	< 2.3.2	2.3.2
apostrophecms	sanitize-html	>= 0 < 2.3.2	2.3.2
debian	node-sanitize-html	—	—

CVSS provenance

nvd v3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:N/I:P/A:N

vendor_debian 5.3 LOW

vendor_redhat 5.3 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20