CVE-2021-23648: Cross-site Scripting (XSS)
A flaw was found in sanitize-url due to improper sanitization in the sanitizeUrl function. This issue causes vulnerability to Cross-site Scripting in sanitize-url.
Other sources
Node.js @braintree/sanitize-url module is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
— IBM
The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-23648?
CVE-2021-23648 is a vulnerability in the sanitize-url package that allows for cross-site scripting (XSS) attacks.
What is the severity of CVE-2021-23648?
CVE-2021-23648 has a severity rating of 6.1, which is considered medium.
How does CVE-2021-23648 impact sanitize-url?
CVE-2021-23648 allows attackers to perform cross-site scripting (XSS) attacks through the sanitizeUrl function in sanitize-url.
What is the remedy for CVE-2021-23648?
The remedy for CVE-2021-23648 is to upgrade to version 6.0.0 of the sanitize-url package.
Where can I find more information about CVE-2021-23648?
You can find more information about CVE-2021-23648 in the bug reports on Bugzilla and the pull request on GitHub.