| Package | Affected versions | Patched versions |
|---|---|---|
| sanitize-html | < 1.0.3 | 1.0.3 |
'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS). The function 'naughtyHref' doesn't properly validate the hyperreference (`href`) attribute in anchor tags (`<a>`), allowing bypasses that contain different casings, whitespace characters, or hexadecimal encodings.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free