Homepage

xhtml-purifier@0.1.3

Simple HTML purifier/cleaner for untrusted HTML.

  • latest version

    0.4.3

  • latest non vulnerable version

    0.4.3

  • first published

    11 years ago

  • latest version published

    4 months ago

  • licenses detected

  • View xhtml-purifier package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the xhtml-purifier package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Improper Encoding or Escaping of Output

    xhtml-purifier is a Simple HTML purifier/cleaner for untrusted HTML.

    Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the attributeString() function in XHTMLPurifier.js, which writes attribute values into double-quoted HTML attributes without entity-encoding them. An attacker who controls an attribute value containing a double-quote character can break out of the quoted attribute context and inject arbitrary additional attributes, including event handlers such as onmouseover, which execute when the purified output is rendered in a browser.

    How to fix Improper Encoding or Escaping of Output?

    Upgrade xhtml-purifier to version 0.4.3 or higher.

    <0.4.3
    Go back to all versions of this package