CVE-2017-0928

html-janitor node module suffers from an External Control of Critical State Data vulnerability via user-control of the '_sanitized' variable causing sanitization to be bypassed.

Score

CVSS 3.0 6.1 Medium

Status

Modified - support@hackerone.com

Published

2018-06-04

Last modified

2024-09-17

Weaknesses

CWE-642

Affected products

• Html-janitor Node Module (Hackerone)
• Html-janitor (Theguardian)

References

• https://github.com/guardian/html-janitor/issues/35
• https://hackerone.com/reports/308158