Improper Encoding or Escaping of Output Affecting apostrophe package, versions <4.30.0

apostrophe is a content management system (CMS) for Node.js. It supports in-context editing, schema-driven content types, flexible widgets and a great deal more. This module contains everything necessary to build a website with ApostropheCMS.

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the linkHref field handling. An attacker can execute arbitrary JavaScript by supplying a javascript: URL in an image widget's link URL field and having it rendered on the page. This affects users who can edit content and allows an attacker to run a script in viewers’ browsers, exposing session data and enabling unauthorized actions on the affected site.

Notes: While the vulnerability was reported for apostrophe, the fix indicates that launder and sanitize-html contained similar flaws which were addressed through improved sanitization

##Workarounds

• Restrict who can edit or publish image widgets so untrusted users cannot set the Link to field to a javascript: URL; this prevents stored XSS from being published to pages viewed by others.

• GitHub Commit
• GitHub Release
• Maintainer's Advisory