Boutell

**Name of the Vulnerable Software and Affected Versions** sanitize-html versions prior to 2.3.1 **Description** The issue arises from improper handling of internationalized domain names (IDN), which could allow an attacker to bypass hostname whitelist validation set by the `allowedIframeHostnames` option. This could potentially lead to malicious activities. **Recommendations** For versions prior to 2.3.1, update to version 2.3.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the `allowedIframeHostnames` option until a patch is applied.