Executive brief
sanitize-html is a Node.js library used to remove potentially harmful HTML from user-supplied content, protecting web applications from malicious scripts. A flaw in its HTML parsing logic fails to properly sanitize certain malformed tags, allowing attackers to inject executable JavaScript code that runs in users' browsers. This could lead to session hijacking, credential theft, or malware distribution through affected websites.
Technical details
The vulnerability is a cross-site scripting (CWE-79) flaw caused by improper handling of malformed HTML attributes during parsing. When processing tags with invalid attribute syntax (e.g., `<IMG SRC= onmouseover="alert('XSS');">`), the parser incorrectly interprets the injected attribute as a quoted value rather than filtering it, resulting in the browser executing the embedded script. The attack requires no authentication and is triggered via user interaction (rendering the malicious HTML in a browser). Affected versions prior to 1.2.3 do not properly strip the event handler, leaving XSS payloads intact. A patch is available in version 1.2.3 and later.
Affected products
- npm sanitize-html < 1.2.3
Timeline
- 2018-11-09: disclosed
- 2017: patched: Fixed in version 1.2.3