MediumGHSA-rm97-x556-q36hCVE-2024-21501
sanitize-html Information Exposure vulnerability
Published 24 Feb 2024 · Updated 10 Sept 2026
Affected package
- Affected
- <2.12.1
- Fixed in
- 2.12.1
Update to the fixed version for your release line, for example:
npm install sanitize-html@2.12.1Details
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.
Is GHSA-rm97-x556-q36h in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected sanitize-html, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2024-21501
- Linkgithub.com/apostrophecms/sanitize-html/pull/650
- Linkgithub.com/apostrophecms/sanitize-html/commit/c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4
- Linkgist.github.com/Slonser/8b4d061abe6ee1b2e10c7242987674cf
- Linkgithub.com/apostrophecms/apostrophe/discussions/4436
- Packagegithub.com/apostrophecms/sanitize-html
- Linklists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EB5JPYRCTS64EA5AMV3INHDPI6I4AW7
- Linklists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P4I5X6V3LYUNBMZ5YOW4BV427TH3IK4S
- Linksecurity.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6276557
- Linksecurity.snyk.io/vuln/SNYK-JS-SANITIZEHTML-6256334
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.