Html
Monthly
Cross-site scripting in SWC's HTML minifier allows attacker-controlled JSON data embedded in application/json and application/ld+json script elements to break out of those elements and execute arbitrary JavaScript in the rendered page's origin. Applications that use swc_html_minifier or @swc/html to minify server-rendered HTML containing dynamic JSON script blocks are vulnerable - the minifier parsed JSON (unescaping unicode-escaped less-than signs) then re-serialized without re-escaping them, letting a crafted closing sequence terminate the script element prematurely. No public exploit has been identified at time of analysis, but the attack technique is a well-understood HTML parser quirk and the fix commit provides a clear reproduction case.
Out-of-bounds read in the HTML::Bare Perl parsing module (versions through 0.04) lets an attacker who supplies truncated or malformed HTML - such as the string "<a/" - force the C-based parserc_parse routine to read past the end of the input buffer. Because the parser performs multi-character lookahead for tokens like "<![CDATA" and element terminators ">" without bounds checks, adjacent heap memory can be disclosed or the process can crash. No public exploit was identified at time of analysis, but an upstream fix (GitHub PR #2) and per-version patches are available.
Denial of service in HTML::Bare through version 0.04, a Perl XML/HTML parsing module, allows remote unauthenticated attackers to hang the parsing process in an infinite loop by supplying malformed markup. The parserc_parse function fails to advance its attribute-parse cursor on certain malformed attribute forms - such as nameless attributes ("<a ='c'>") or unbalanced quotes ("<a b='''''''c'>") - causing the CPU to spin indefinitely. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.19%, 8th percentile), consistent with a resource-exhaustion bug rather than a high-value target.
Heap memory disclosure in the Perl HTML::Gumbo module before 0.19 lets remote attackers leak bounded chunks of process heap by submitting HTML containing a <template> element. The XS binding's walk_tree function misclassifies the template node as a text node and runs strlen() past the intended buffer, serializing the over-read bytes into parse() output. No public exploit is identified at time of analysis, and EPSS is low (0.66%), but exploitation is automatable and the flaw is trivially triggerable against any service that parses untrusted HTML with the default settings.
Heap information disclosure in HTML::Entities for Perl (versions before 3.84) allows remote attackers to leak adjacent heap memory contents when decoding entities. The XS routine _decode_entities retains a stale pointer into a hash value SV after grow_gap() reallocates the buffer, causing a use-after-free read that copies freed heap bytes into the output scalar. No public exploit identified at time of analysis and EPSS is very low (0.02%), but the upstream fix is confirmed via GH PR #56.
The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content. [CVSS 5.3 MEDIUM]
Html contains a vulnerability that allows attackers to denial of service (DoS) if an attacker provides specially crafted HTML content (CVSS 5.3).
Session::Cookie in the HTML::EP module 0.2011 for Perl does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via a crafted request, which is not. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-site scripting in SWC's HTML minifier allows attacker-controlled JSON data embedded in application/json and application/ld+json script elements to break out of those elements and execute arbitrary JavaScript in the rendered page's origin. Applications that use swc_html_minifier or @swc/html to minify server-rendered HTML containing dynamic JSON script blocks are vulnerable - the minifier parsed JSON (unescaping unicode-escaped less-than signs) then re-serialized without re-escaping them, letting a crafted closing sequence terminate the script element prematurely. No public exploit has been identified at time of analysis, but the attack technique is a well-understood HTML parser quirk and the fix commit provides a clear reproduction case.
Out-of-bounds read in the HTML::Bare Perl parsing module (versions through 0.04) lets an attacker who supplies truncated or malformed HTML - such as the string "<a/" - force the C-based parserc_parse routine to read past the end of the input buffer. Because the parser performs multi-character lookahead for tokens like "<![CDATA" and element terminators ">" without bounds checks, adjacent heap memory can be disclosed or the process can crash. No public exploit was identified at time of analysis, but an upstream fix (GitHub PR #2) and per-version patches are available.
Denial of service in HTML::Bare through version 0.04, a Perl XML/HTML parsing module, allows remote unauthenticated attackers to hang the parsing process in an infinite loop by supplying malformed markup. The parserc_parse function fails to advance its attribute-parse cursor on certain malformed attribute forms - such as nameless attributes ("<a ='c'>") or unbalanced quotes ("<a b='''''''c'>") - causing the CPU to spin indefinitely. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.19%, 8th percentile), consistent with a resource-exhaustion bug rather than a high-value target.
Heap memory disclosure in the Perl HTML::Gumbo module before 0.19 lets remote attackers leak bounded chunks of process heap by submitting HTML containing a <template> element. The XS binding's walk_tree function misclassifies the template node as a text node and runs strlen() past the intended buffer, serializing the over-read bytes into parse() output. No public exploit is identified at time of analysis, and EPSS is low (0.66%), but exploitation is automatable and the flaw is trivially triggerable against any service that parses untrusted HTML with the default settings.
Heap information disclosure in HTML::Entities for Perl (versions before 3.84) allows remote attackers to leak adjacent heap memory contents when decoding entities. The XS routine _decode_entities retains a stale pointer into a hash value SV after grow_gap() reallocates the buffer, causing a use-after-free read that copies freed heap bytes into the output scalar. No public exploit identified at time of analysis and EPSS is very low (0.02%), but the upstream fix is confirmed via GH PR #56.
The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content. [CVSS 5.3 MEDIUM]
Html contains a vulnerability that allows attackers to denial of service (DoS) if an attacker provides specially crafted HTML content (CVSS 5.3).
Session::Cookie in the HTML::EP module 0.2011 for Perl does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via a crafted request, which is not. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.