XSS in HtmlSanitizer
概要
XSS in HtmlSanitizer
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Impact
If you have explicitly allowed the tag, an attacker could craft HTML that includes script after passing through the sanitizer. The default settings disallow the tag so there is no risk if you have not explicitly allowed the `` tag.
Patches
The problem has been fixed in version 5.0.372.
Workarounds
Remove the `` tag from the set of allowed tags.
For more information
If you have any questions or comments about this advisory open an issue in https://github.com/mganss/HtmlSanitizer
Credits
This issue was discovered by Michal Bentkowski of Securitum.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
参照URL
- advisory nvd.nist.gov
- web github.com
- web github.com
- web github.com
- web nuget.org