PT-2021-11234 · Unknown · Sanitize-Html

Michał Bentkowski · Published 2021-01-04 · Updated 2021-01-07 · CVE-2020-26293

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: HtmlSanitizer versions prior to 5.0.372

Description: The issue allows for a possible XSS bypass if the <style> tag is allowed. An attacker could craft HTML that includes script after passing through the sanitizer if the <style> tag has been explicitly allowed. The default settings disallow the <style> tag, posing no risk if it has not been explicitly allowed.

Recommendations: For versions prior to 5.0.372, update to version 5.0.372 to resolve the issue. As a temporary workaround, consider removing the <style> tag from the set of allowed tags until a patch is applied.

Fix

Special Elements Injection

XSS

Weakness Enumeration

CWE-74

CWE-79

Related Identifiers

CVE-2020-26293

GHSA-8J9V-H2VP-2HHV

Affected Products

Sanitize-Html

References · 8

• https://github.com/mganss/HtmlSanitizer/commit/a3a7602a44d4155d51ec0fbbedc2a49e9c7e2eb8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-26293 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26293 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8j9v-h2vp-2hhv · Vendor Advisory
• https://github.com/mganss/HtmlSanitizer/releases/tag/v5.0.372 · Note
• https://github.com/mganss/HtmlSanitizer/security/advisories/GHSA-8j9v-h2vp-2hhv · Note
• https://nuget.org/packages/HtmlSanitizer · Note
• https://t.me/cibsecurity/21554 · Telegram Post