Node Xhtml Purifier
Monthly
Attribute-injection cross-site scripting in xhtml-purifier (npm package node-xhtml-purifier) before 0.4.3 lets an attacker who can supply HTML to the sanitizer smuggle a JavaScript event handler - for example onmouseover or onerror - past purification so that it executes when the purified output is rendered in a browser. The serializer in XHTMLPurifier.js writes each attribute value straight into a double-quoted attribute without HTML-entity encoding, so a double quote inside any allowed attribute (class, style, title, alt, src, href) terminates the attribute and starts a new one, converting data into markup. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, score 6.1) indicates no authentication requirement but a user-interaction prerequisite, since the victim must render the output and, for handlers like onmouseover, trigger the element; this is a genuine sanitizer bypass but a moderate-priority issue overall, and exploitation is contingent on an application actually passing attacker-controlled HTML through this niche library. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Attribute-injection cross-site scripting in xhtml-purifier (npm package node-xhtml-purifier) before 0.4.3 lets an attacker who can supply HTML to the sanitizer smuggle a JavaScript event handler - for example onmouseover or onerror - past purification so that it executes when the purified output is rendered in a browser. The serializer in XHTMLPurifier.js writes each attribute value straight into a double-quoted attribute without HTML-entity encoding, so a double quote inside any allowed attribute (class, style, title, alt, src, href) terminates the attribute and starts a new one, converting data into markup. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, score 6.1) indicates no authentication requirement but a user-interaction prerequisite, since the victim must render the output and, for handlers like onmouseover, trigger the element; this is a genuine sanitizer bypass but a moderate-priority issue overall, and exploitation is contingent on an application actually passing attacker-controlled HTML through this niche library. No public exploit code and no confirmed active exploitation were identified at time of analysis.