Quick answers
- Is CVE-2017-16017 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2017-16017 being exploited in the wild.
- How severe is CVE-2017-16017?
- Low severity, with a CVSS score of 3, published 9 November 2018.
- Which products and versions are affected?
- sanitize-html (npm) < 1.2.3.
- Is there a fix for CVE-2017-16017?
- A patch was published on 2017: Fixed in version 1.2.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2017-16017 attacked?
- It is attacked over the network.
- Am I affected by CVE-2017-16017?
- Check whether you run sanitize-html (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a cross-site scripting (CWE-79) flaw caused by improper handling of malformed HTML attributes during parsing. When processing tags with invalid attribute syntax (e.g., `<IMG SRC= onmouseover="alert('XSS');">`), the parser incorrectly interprets the injected attribute as a quoted value rather than filtering it, resulting in the browser executing the embedded script. The attack requires no authentication and is triggered via user interaction (rendering the malicious HTML in a browser). Affected versions prior to 1.2.3 do not properly strip the event handler, leaving XSS payloads intact. A patch is available in version 1.2.3 and later.
Affected products
- npm sanitize-html < 1.2.3
Identifiers
- CVE-2017-16017
- GHSA-wg96-3933-j2w5
Timeline
- 2018-11-09: disclosed
- 2017: patched: Fixed in version 1.2.3