CVE-2022-21169

Katalog CVE

CVSS 6.1 · Medium EPSS 0,95%

Kerentanan Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') pada express xss sanitizer project express xss sanitizer. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization.

Rincian

Terbit di NVD

26 September 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

0,95% peluang dieksploitasi; lebih tinggi dari 60,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/AhmedAdelFahim/express-xss-sanitizer/commit/3bf8aaaf4dbb1c209dcb8d87a82711a54c1ab39a patch · advisory pihak ketiga
• https://runkit.com/embed/w306l6zfm7tu patch · advisory pihak ketiga · url repurposed
• https://github.com/AhmedAdelFahim/express-xss-sanitizer/issues/4 exploit · issue tracking · advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-JS-EXPRESSXSSSANITIZER-3027443 exploit · advisory pihak ketiga