XSS in HtmlSanitizer
Résumé
XSS in HtmlSanitizer
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Impact
If you have explicitly allowed the tag, an attacker could craft HTML that includes script after passing through the sanitizer. The default settings disallow the tag so there is no risk if you have not explicitly allowed the `` tag.
Patches
The problem has been fixed in version 5.0.372.
Workarounds
Remove the `` tag from the set of allowed tags.
For more information
If you have any questions or comments about this advisory open an issue in https://github.com/mganss/HtmlSanitizer
Credits
This issue was discovered by Michal Bentkowski of Securitum.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Références
- advisory nvd.nist.gov
- web github.com
- web github.com
- web github.com
- web nuget.org