CVE-2024-21501: Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed…

PriorityP430medium5.3CVSS 3.1

AVNACLPRNUINSUCLINAN

EPSS

1.02%

59.0th percentile

Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
apostrophecms	sanitize-html	< 2.12.1	2.12.1
apostrophecms	sanitize-html	>= 0 < 2.12.1	2.12.1
debian	node-sanitize-html	< node-sanitize-html 2.13.0+~2.11.0-1 (forky)	node-sanitize-html 2.13.0+~2.11.0-1 (forky)
fedoraproject	fedora	—	—
fedoraproject	fedora	—	—

CVSS provenance

nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

osv5.3MEDIUM

vendor_debian5.3MEDIUM

vendor_redhat5.3MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.