#VU88968 Cross-site scripting in sanitize - CVE-2023-36823

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data when parsing "style" elements. A remote attacker can execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Remediation

External links

• https://github.com/rgrove/sanitize/security/advisories/GHSA-f5ww-cq3m-q3g7
• https://github.com/rgrove/sanitize/commit/76ed46e6dc70820f38efe27de8dabd54dddb5220
• https://github.com/rgrove/sanitize/releases/tag/v6.0.2
• https://lists.debian.org/debian-lts-announce/2023/11/msg00008.html