PT-2023-28331 · Lol-Html · Lol-Html

Inikulin · Published 2023-08-09 · Updated 2023-08-22 · CVE-2023-4241

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions lol-html versions prior to 1.1.1

Description The issue causes panics on certain HTML inputs. Anyone processing arbitrary 3rd party HTML with the library is affected.

Recommendations For versions prior to 1.1.1, update to version 1.1.1 to resolve the issue. As a temporary workaround, consider avoiding the processing of arbitrary 3rd party HTML with the library until the update is applied.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2023-4241

GHSA-C3X7-354F-4P2X

Affected Products

Lol-Html

References · 9

• https://github.com/cloudflare/lol-html/security/advisories/GHSA-c3x7-354f-4p2x · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c3x7-354f-4p2x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4241 · Security Note
• https://osv.dev/vulnerability/CVE-2023-4241 · Vendor Advisory
• https://github.com/cloudflare/lol-html · Note
• https://twitter.com/VulmonFeeds/status/1691794633448149466 · Twitter Post
• https://twitter.com/CVEnew/status/1691759602549891135 · Twitter Post
• https://t.me/cvenotify/57088 · Telegram Post
• https://t.me/cibsecurity/68629 · Telegram Post