XSS in HtmlSanitizer
Summary
XSS in HtmlSanitizer
Original description
The description as published by the source.
Impact
If you have explicitly allowed the tag, an attacker could craft HTML that includes script after passing through the sanitizer. The default settings disallow the tag so there is no risk if you have not explicitly allowed the `` tag.
Patches
The problem has been fixed in version 5.0.372.
Workarounds
Remove the `` tag from the set of allowed tags.
For more information
If you have any questions or comments about this advisory open an issue in https://github.com/mganss/HtmlSanitizer
Credits
This issue was discovered by Michal Bentkowski of Securitum.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
References
- advisory nvd.nist.gov
- web github.com
- web github.com
- web github.com
- web nuget.org