Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact If the template tag is allowed, its contents are not sanitized. The template tag is a special tag that does not usually render its contents, unless the shadowrootmode attribute is set to open or closed. The lack of sanitization of the template tag brings up two bypasses: 1. it is still possible to forcibly render the contents of a <template tag through mutation XSS. The DOM parsers in browsers such as Chromium have a node depth limit of 512 and tags which are beyond that depth are flattened. This in turn allows elements within <template (which are not sanitized) to be effectively 'popped out'. An example would look like this: <div[...]<template<scriptalert('xss')</script where [...] denotes at least another 509 opening <div tags. 2. If in addition to the template tag, the shadowrootmode attribute is allowed through sanitizer.AllowedAttributes.Add("shadowrootmode");, the simple payload of <div<template shadowrootmode="open"<scriptalert('xss')</script would bypass the sanitizer.…
Recommended action: Upgrade to 9.1.893-beta (pre-release) or 9.0.892 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The vulnerability occurs in configurations where foreign content is allowed, i.e. either svg or math are in the list of allowed elements. Specifically, the requirements for the vulnerability are: 1. Allowing one foreign element: svg, or math 2. Comments or one raw text element: iframe, noembed, xmp, title, noframes, style or noscript Configurations that meet the above requirements plus the following are vulnerable to an additional vulnerability: - Any HTML integration element: title, desc, mi, mo, mn, ms, mtext, annotation-xml. In case an application sanitizes user input with a vulnerable configuration, an attacker could bypass the sanitization and inject arbitrary HTML, including JavaScript code. Note that in the default configuration the vulnerability is not present. Patches The vulnerability has been fixed in versions 8.0.723 and 8.1.722-beta (preview version). Workarounds Disallow foreign elements svg and math. This is the case in the default configuration, which is…
Recommended action: Upgrade to 8.1.722-beta (pre-release) or 8.0.723 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact If you have explicitly allowed the <style tag, an attacker could craft HTML that includes script after passing through the sanitizer. The default settings disallow the <style tag so there is no risk if you have not explicitly allowed the <style tag. Patches The problem has been fixed in version 5.0.372. Workarounds Remove the <style tag from the set of allowed tags. For more information If you have any questions or comments about this advisory open an issue in https://github.com/mganss/HtmlSanitizer Credits This issue was discovered by Michal Bentkowski of Securitum.
Recommended action: Upgrade to 5.0.372 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.