express-xss-sanitizer vulnerable to Prototype Pollution via allowedTags attribute

MÉDIO 6.1CVE-2022-21169 · GHSA-grjp-4jmr-mjcw · Published 26/09/2022 · updated 17/06/2026

Em resumo

CVE-2022-21169 é uma vulnerabilidade MÉDIO (CVSS 6.1) que afeta express xss sanitizer (express xss sanitizer project), express-xss-sanitizer.
Chance de exploração nos próximos 30 dias (EPSS): 0.95%, maior que 61.6% das vulnerabilidades.
Correção: atualize para 1.1.3 ou posterior.

Package	Affected versions	Patched versions
express xss sanitizer express_xss_sanitizer_project	`< 1.1.3`	`1.1.3`
express-xss-sanitizer npm	`< 1.1.3`	`1.1.3`

Description

The package express-xss-sanitizer before 1.1.3 is vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization.

NVD description

The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization.

References

nvd.nist.gov/vuln/detail/CVE-2022-21169 · ADVISORY
AhmedAdelFahim/express-xss-sanitizer · WEB
AhmedAdelFahim/express-xss-sanitizer commit 3bf8aaa · WEB
AhmedAdelFahim/express-xss-sanitizer · PACKAGE
runkit.com/embed/w306l6zfm7tu · WEB
security.snyk.io/vuln/SNYK-JS-EXPRESSXSSSANITIZER-3027443 · WEB

Mais vulnerabilidades de express xss sanitizer

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

express xss sanitizer

express_xss_sanitizer_project

< 1.1.3

1.1.3

express-xss-sanitizer

npm

< 1.1.3

1.1.3

Description

The package express-xss-sanitizer before 1.1.3 is vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization.

NVD description

The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization.