CVE-2023-36823

Katalog CVE

CVSS 6.1 · Medium EPSS 0,71%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada sanitize project sanitize, debian linux. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Sanitize is an allowlist-based HTML and CSS sanitizer. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML and CSS through Sanitize starting with version 3.0.0 and prior to version 6.0.2 when Sanitize is configured to use the built-in "relaxed" config or when using a custom config that allows `style` elements and one or more CSS at-rules. This could result in cross-site scripting or other undesired behavior when the malicious HTML and CSS are rendered in a browser. Sanitize 6.0.2 performs additional escaping of CSS in `style` element content, which fixes this issue. Users who are unable to upgrade can prevent this issue by using a Sanitize config that doesn't allow `style` elements, using a Sanitize config that doesn't allow CSS at-rules, or by manually escaping the character sequence `</` as `<\/` in `style` element content.

Rincian

Terbit di NVD

6 Juli 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,71% peluang dieksploitasi; lebih tinggi dari 52,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/rgrove/sanitize/security/advisories/GHSA-f5ww-cq3m-q3g7 advisory vendor
• https://github.com/rgrove/sanitize/commit/76ed46e6dc70820f38efe27de8dabd54dddb5220 patch
• https://github.com/rgrove/sanitize/releases/tag/v6.0.2 release notes
• https://lists.debian.org/debian-lts-announce/2023/11/msg00008.html mailing list