Description
html-janitor node module suffers from an External Control of Critical State Data vulnerability via user-control of the '_sanitized' variable causing sanitization to be bypassed.
Remediation
References
https://github.com/guardian/html-janitor/issues/35
https://hackerone.com/reports/308158
Related Vulnerabilities
CVE-2021-23438 Vulnerability in npm package mpath
CVE-2018-11040 Vulnerability in maven package org.springframework:spring-webmvc
CVE-2023-47440 Vulnerability in npm package gladys
CVE-2022-1291 Vulnerability in maven package org.webjars.bowergithub.hhurz:tableexport.jquery.plugin
CVE-2021-31405 Vulnerability in maven package com.vaadin:vaadin-text-field-flow