CVE-2014-125128
MEDIUMsanitize-html < 1.0.3 - Cross-Site Scripting via Improper Href Attribute Validation
Title source: llmDescription
'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS). The function 'naughtyHref' doesn't properly validate the hyperreference (`href`) attribute in anchor tags (`<a>`), allowing bypasses that contain different casings, whitespace characters, or hexadecimal encodings.
References (4)
Core 4
Core References
Issue Tracking, Vendor Advisory issue-tracking
https://github.com/apostrophecms/sanitize-html/issues/1
Patch patch
https://github.com/apostrophecms/sanitize-html/commit/889d4ec968e175f1905b2eb9d33f1fa89217cb02
Patch patch
https://github.com/apostrophecms/sanitize-html/commit/423b90e06e1e85245eccedaabeb3a82840c6cd86
Exploit, Third Party Advisory exploit
https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2014/CVE-2014-125128
Scores
CVSS v3
6.1
EPSS
0.0026
EPSS Percentile
16.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-79
Status
published
Products (1)
apostrophecms/sanitize-html
< 1.0.3
Published
Sep 08, 2025
Tracked Since
Feb 18, 2026