CVE-2021-3377: XSS
A flaw was found in npm package ansiup versions < 5.0.0 when parsing untrusted user input. An attacker could take advantage of this by introducing ANSI escape codes to inject arbitrary HTML and JavaScript in result mounting a cross-site scripting (XSS) attack.
Other sources
Node.js ansiup module is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
— IBM
The npm package ansiup converts ANSI escape codes into HTML. In ansiup v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, this feature is affected by a cross-site scripting (XSS) vulnerability. This issue is fixed in v5.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/ansi_upto a version that resolves this vulnerability.Fixed in 5.0.0
Event History
Frequently Asked Questions
What is the severity of CVE-2021-3377?
CVE-2021-3377 is classified as a high severity vulnerability due to its potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2021-3377?
To fix CVE-2021-3377, you should update the ansi_up package to version 5.0.0 or later.
What types of software are affected by CVE-2021-3377?
CVE-2021-3377 affects npm package ansi_up versions below 5.0.0, particularly in applications using affected versions like IBM Cognos Analytics.
Can CVE-2021-3377 lead to data breaches?
Yes, CVE-2021-3377 can potentially lead to data breaches by allowing attackers to inject malicious scripts into web applications.
Is there a workaround for CVE-2021-3377?
The most effective workaround for CVE-2021-3377 is to update the ansi_up package to a secure version, as no temporary fix is provided.