← voltar
CVE-2022-21169

Prototype Pollution

CVSS 7.3 HIGHEPSS 0.7%CWE-1321
The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P
Produtos afetados
n/a · express-xss-sanitizer

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →
Referências
https://github.com/AhmedAdelFahim/express-xss-sanitizer/commit/3bf8aaaf4dbb1c209dcb8d87a82711a54c1ab39ahttps://github.com/AhmedAdelFahim/express-xss-sanitizer/issues/4https://runkit.com/embed/w306l6zfm7tuhttps://security.snyk.io/vuln/SNYK-JS-EXPRESSXSSSANITIZER-3027443