Medium severity · published Feb 24, 2024
CVE-2024-21501
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of…
5.3
CVSS
1%
EPSS
No
On KEV
Description
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FE
Fedora · Fedoraproject
39; 40 · source: NVD
SA
Sanitize-html · Apostrophecms
before 2.12.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-21501
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-21501
Exploit
https://gist.github.com/Slonser/8b4d061abe6ee1b2e10c7242987674cf
Issue Tracking
https://github.com/apostrophecms/apostrophe/discussions/4436
Patch
https://github.com/apostrophecms/sanitize-html/commit/c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4
Patch
https://github.com/apostrophecms/sanitize-html/pull/650
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EB5JPYRCTS64EA5AMV3INHDPI6I4AW7/
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P4I5X6V3LYUNBMZ5YOW4BV427TH3IK4S/
More from Sanitize-html
9.3
CVE-2026-44990
Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`
7.5
CVE-2022-25887
The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment…
6.1
CVE-2026-40186
ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements
6.1
CVE-2014-125128
'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS)
6.1
CVE-2019-25225
`sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS)