Dylan Armstrong

3 exploits Active since Feb 2021
CVE-2021-26539 WRITEUP MEDIUM WRITEUP
Apostrophe Technologies sanitize-html <2.3.1 - Info Disclosure
Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option.
CVSS 5.3
CVE-2021-26540 WRITEUP MEDIUM WRITEUP
Apostrophe Technologies sanitize-html <2.3.2 - Open Redirect
Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with "/\\example.com".
CVSS 5.3
CVE-2024-21501 WRITEUP MEDIUM WRITEUP
sanitize-html < 2.12.1 - Information Exposure via Style Attribute
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.
CVSS 5.3