PT-2021-17027 · Unknown · Sanitize-Html

Ron Masas · Published 2021-02-08 · Updated 2026-06-04 · CVE-2021-26540

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions sanitize-html versions prior to 2.3.2

Description The issue arises from improper validation of hostnames set by the allowedIframeHostnames option when allowIframeRelativeUrls is set to true. This allows attackers to bypass the hostname whitelist for iframe elements by using an src value that starts with "/example.com".

Recommendations For versions prior to 2.3.2, update to version 2.3.2 or later to resolve the issue. As a temporary workaround, consider setting allowIframeRelativeUrls to false to prevent the bypass of the hostname whitelist. Restrict access to iframe elements with src values starting with "/example.com" to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2021-26540

GHSA-MJXR-4V3X-Q3M4

Affected Products

Sanitize-Html

References · 9

• 🔥 https://advisory.checkmarx.net/advisory/CX-2021-4309 · Exploit
• https://github.com/apostrophecms/sanitize-html/pull/460 · Patch
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2021-26540 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-26540 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26540 · Security Note
• https://osv.dev/vulnerability/GHSA-mjxr-4v3x-q3m4 · Vendor Advisory
• https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#232-2021-01-26 · Note
• https://t.me/cvenotify/11982 · Telegram Post
• https://t.me/cibsecurity/23221 · Telegram Post