Sanitize vulnerable to Cross-site Scripting via insufficient neutralization of `style` element content

CVE-2023-36823

What is CVE-2023-36823?

An issue has been identified in Sanitize, an HTML and CSS sanitizer, which may allow an attacker to inject arbitrary HTML and CSS. This vulnerability arises when Sanitize is configured with the built-in 'relaxed' settings or custom settings that permit 'style' elements alongside specific CSS at-rules. It could lead to cross-site scripting (XSS) attacks if the crafted input is executed by a browser. The vulnerability affects versions 3.0.0 to 6.0.1, and upgrading to version 6.0.2 is recommended as it adds further escaping measures to protect against such exploitation. Alternatively, users can modify their Sanitize configurations to disallow 'style' elements or CSS at-rules.

References