MediumGHSA-6fh7-fwqj-mv49CVE-2007-3498

HTML Purifier Cross-site Scripting vulnerability

Published 1 May 2022 · Updated 29 Oct 2024

Affected package

Affected: <2.0.1
Fixed in: 2.0.1

Update to the fixed version for your release line, for example:composer require ezyang/htmlpurifier:^2.0.1

Details

Cross-site scripting (XSS) vulnerability in smoketests/configForm.php in HTML Purifier before 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "unescaped print_r output."

Is GHSA-6fh7-fwqj-mv49 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected ezyang/htmlpurifier, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisorynvd.nist.gov/vuln/detail/CVE-2007-3498
Linkgithub.com/ezyang/htmlpurifier/commit/96b571d23639bd70768b8db626ecaf8bbb7ca5a3
Linkexchange.xforce.ibmcloud.com/vulnerabilities/35300
Packagegithub.com/ezyang/htmlpurifier
Linkgithub.com/ezyang/htmlpurifier/commits/v2.0.1/smoketests/configForm.php
Linkweb.archive.org/web/20200228110020/http://www.securityfocus.com/bid/24699
Linkhtmlpurifier.org/svnroot/htmlpurifier/tags/2.0.1/NEWS

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.