{"id":"CVE-2021-26539","published":"2021-02-08T16:16:06Z","modified":"2024-08-03T20:26:25Z","title":"Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which…","vendor":null,"product":null,"tier":"tail","description":{"text":"Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the \"allowedIframeHostnames\" option.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01953,"percentile":0.80254,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#231-2021-01-22","tags":["x_refsource_MISC"]},{"url":"https://github.com/apostrophecms/sanitize-html/pull/458","tags":["x_refsource_MISC"]},{"url":"https://advisory.checkmarx.net/advisory/CX-2021-4308","tags":["x_refsource_MISC"]}],"priority":{"score":16.1,"factors":[{"name":"EPSS percentile","points":16.05}]},"affected":[{"ecosystem":"npm","package":"sanitize-html","vulnerableRanges":["<2.3.1"],"patched":["2.3.1"],"from":["GHSA-rjqq-98f6-6j3r"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-1183","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2016-1000237","published":"2020-01-23","fixed":"1.4.3","kev":false},{"cve":"CVE-2017-16016","published":"2018-06-04","fixed":"1.11.4","kev":false},{"cve":"CVE-2019-25225","published":"2025-09-08","fixed":"2.0.0-beta","kev":false},{"cve":"CVE-2021-26539","published":"2021-02-08","fixed":"2.3.1","kev":false},{"cve":"CVE-2021-26540","published":"2021-02-08","fixed":"2.3.2","kev":false,"link":{"from":"CVE-2021-26539","to":"CVE-2021-26540","relation":"successor","confidence":"medium","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"npm:sanitize-html","fromFixed":"2.3.1","toFixed":"2.3.2","daysApart":0},{"kind":"similar","provenance":"machine","score":0.57,"basis":"same package + description similarity"}]}},{"cve":"CVE-2022-25887","published":"2022-08-30","fixed":"2.7.1","kev":false},{"cve":"CVE-2024-21501","published":"2024-02-24","fixed":"2.12.1","kev":false}],"package":"npm:sanitize-html"}}