Cross-Site Scripting Vulnerability in html-janitor Node Module by Guardian
CVE-2017-0931

6.1MEDIUM

Key Information:

Vendor

Hackerone

Status
Html-janitor Node Module
Vendor
CVE Published:
4 June 2018

What is CVE-2017-0931?

The html-janitor node module is vulnerable to Cross-Site Scripting (XSS) due to the clean() function allowing the acceptance of user-controlled input. This can result in untrusted data being processed, leading to potential exploitation. Developers using this module should validate and sanitize inputs properly to mitigate risks and ensure secure application behavior.

Affected Version(s)

html-janitor node module All versions

References

https://github.com/guardian/html-janitor/issues/34
x_refsource_MISC
https://hackerone.com/reports/308155
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2017-0931 : Cross-Site Scripting Vulnerability in html-janitor Node Module by Guardian