← volver
CVE-2022-21169

Prototype Pollution

CVSS 7.3 HIGHEPSS 0.7%CWE-1321
The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P
Productos afectados
n/a · express-xss-sanitizer

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →
Referencias
https://github.com/AhmedAdelFahim/express-xss-sanitizer/commit/3bf8aaaf4dbb1c209dcb8d87a82711a54c1ab39ahttps://github.com/AhmedAdelFahim/express-xss-sanitizer/issues/4https://runkit.com/embed/w306l6zfm7tuhttps://security.snyk.io/vuln/SNYK-JS-EXPRESSXSSSANITIZER-3027443