Nariyoshi Chida

2 exploits Active since Feb 2021
CVE-2021-26539 WRITEUP MEDIUM WRITEUP
Apostrophe Technologies sanitize-html <2.3.1 - Info Disclosure
Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option.
CVSS 5.3
CVE-2021-26540 WRITEUP MEDIUM WRITEUP
Apostrophe Technologies sanitize-html <2.3.2 - Open Redirect
Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with "/\\example.com".
CVSS 5.3