PT-2021-17026 · Unknown · Sanitize-Html

Boutell · Published 2021-02-08 · Updated 2026-06-04 · CVE-2021-26539

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions sanitize-html versions prior to 2.3.1

Description The issue arises from improper handling of internationalized domain names (IDN), which could allow an attacker to bypass hostname whitelist validation set by the allowedIframeHostnames option. This could potentially lead to malicious activities.

Recommendations For versions prior to 2.3.1, update to version 2.3.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the allowedIframeHostnames option until a patch is applied.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2021-26539

GHSA-RJQQ-98F6-6J3R

Affected Products

Sanitize-Html

References · 11

• 🔥 https://advisory.checkmarx.net/advisory/CX-2021-4308 · Exploit
• https://github.com/apostrophecms/sanitize-html/pull/458 · Patch
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2021-26539 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rjqq-98f6-6j3r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26539 · Security Note
• https://osv.dev/vulnerability/CVE-2021-26539 · Vendor Advisory
• https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#231-2021-01-22 · Note
• https://github.com/apostrophecms/sanitize-html · Note
• https://github.com/apostrophecms/sanitize-html/commit/bdf7836ef8f0e5b21f9a1aab0623ae8fcd09c1da · Note
• https://t.me/cibsecurity/23227 · Telegram Post
• https://t.me/cvenotify/11981 · Telegram Post