XSS in HtmlSanitizer
GHSA-8j9v-h2vp-2hhv · CVE-2020-26293
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Impact
If you have explicitly allowed the <style> tag, an attacker could craft HTML that includes script after passing through the sanitizer. The default settings disallow the <style> tag so there is no risk if you have not explicitly allowed the <style> tag.
Patches
The problem has been fixed in version 5.0.372.
Workarounds
Remove the <style> tag from the set of allowed tags.
For more information
If you have any questions or comments about this advisory open an issue in https://github.com/mganss/HtmlSanitizer
Credits
This issue was discovered by Michal Bentkowski of Securitum.
References
- WEB https://github.com/mganss/HtmlSanitizer/security/advisories/GHSA-8j9v-h2vp-2hhv
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2020-26293
- WEB https://github.com/mganss/HtmlSanitizer/commit/a3a7602a44d4155d51ec0fbbedc2a49e9c7e2eb8
- WEB https://github.com/mganss/HtmlSanitizer/releases/tag/v5.0.372
- WEB https://www.nuget.org/packages/HtmlSanitizer
Ready to move
Start Securing
Free, no credit card | First findings in minutes