Executive brief
html-purify is an npm package used to sanitize and clean HTML content by removing potentially dangerous elements and attributes. A vulnerability in all versions allows attackers to bypass the sanitization by injecting malicious JavaScript code through the data attribute in object tags, enabling cross-site scripting (XSS) attacks. Users of this package should consider switching to an alternative sanitization library until a fix is released.
Technical details
This is a cross-site scripting (XSS) vulnerability in html-purify caused by inadequate sanitization of the data attribute within HTML object tags. The vulnerability allows attackers to inject javascript: URIs through this attribute, which bypasses the library's filtering mechanisms and results in arbitrary JavaScript code execution in the context of the affected application. The attack requires no authentication and can be triggered by providing malicious HTML input to the purify function. All versions up to and including 1.1.0 are vulnerable, with no official patch currently available.
Affected products
- npm html-purify 0 to 1.1.0
Timeline
- 2020-12-04: disclosed