Executive brief
html-janitor is a JavaScript library used to sanitize and clean HTML content. Versions prior to 2.0.2 contain a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts if user-controlled data is passed through the library's clean() function. This could enable account takeover, credential theft, or data exfiltration from affected users.
Technical details
html-janitor versions before 2.0.2 fail to properly sanitize HTML input, allowing cross-site scripting (CWE-79) attacks. The vulnerability is triggered when untrusted user-controlled data is passed to the clean() function without adequate filtering of script tags or event handlers. The attack requires user interaction (rendering the malicious content in a browser) but no authentication. An attacker can inject arbitrary JavaScript that executes in the victim's browser context, potentially accessing cookies, session tokens, or sensitive page data. A patch was released in version 2.0.3.
Affected products
- Guardian html-janitor < 2.0.3
Timeline
- 2018-11-09: disclosed