Cross-Site Scripting in html-janitor

MITTEL 6.1CVE-2017-0931 · GHSA-hfj4-96f7-6r5g · Published 04/06/2018 · updated 17/06/2026

Kurz gesagt

CVE-2017-0931 ist eine Schwachstelle (MITTEL (CVSS 6.1)) in html-janitor (html-janitor project), html-janitor.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.0%, höher als bei 64.4% aller Schwachstellen.
Abhilfe: auf 2.0.3 oder neuer aktualisieren.

Package	Affected versions	Patched versions
html-janitor html-janitor_project	`= 2.0.2`	No fix yet
html-janitor npm	`< 2.0.3`	`2.0.3`

Versions of html-janitor prior to 2.0.2 (all current versions) are vulnerable to cross-site scripting (XSS).

This is exploitable if user-controlled data is passed into the modules clean() function.

No fix is currently available for this vulnerability. It is recommended to use an alternative module for HTML sanitization.

NVD description

html-janitor node module suffers from a Cross-Site Scripting (XSS) vulnerability via clean() accepting user-controlled values.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.