Vulnerability Description
Sanitize is an allowlist-based HTML and CSS sanitizer. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML and CSS through Sanitize starting with version 3.0.0 and prior to version 6.0.2 when Sanitize is configured to use the built-in "relaxed" config or when using a custom config that allows `style` elements and one or more CSS at-rules. This could result in cross-site scripting or other undesired behavior when the malicious HTML and CSS are rendered in a browser. Sanitize 6.0.2 performs additional escaping of CSS in `style` element content, which fixes this issue. Users who are unable to upgrade can prevent this issue by using a Sanitize config that doesn't allow `style` elements, using a Sanitize config that doesn't allow CSS at-rules, or by manually escaping the character sequence `</` as `<\/` in `style` element content.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Sanitize Project | Sanitize | >= 3.0.0, < 6.0.2 |
| Debian | Debian Linux | 10.0 |
Related Weaknesses (CWE)
References
- https://github.com/rgrove/sanitize/commit/76ed46e6dc70820f38efe27de8dabd54dddb52Patch
- https://github.com/rgrove/sanitize/releases/tag/v6.0.2Release Notes
- https://github.com/rgrove/sanitize/security/advisories/GHSA-f5ww-cq3m-q3g7Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2023/11/msg00008.htmlMailing List
- https://github.com/rgrove/sanitize/commit/76ed46e6dc70820f38efe27de8dabd54dddb52Patch
- https://github.com/rgrove/sanitize/releases/tag/v6.0.2Release Notes
- https://github.com/rgrove/sanitize/security/advisories/GHSA-f5ww-cq3m-q3g7Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2023/11/msg00008.htmlMailing List
FAQ
What is CVE-2023-36823?
CVE-2023-36823 is a vulnerability with a CVSS score of 7.1 (HIGH). Sanitize is an allowlist-based HTML and CSS sanitizer. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML and CSS through Sanitize starting with version 3.0.0 and prior to ...
How severe is CVE-2023-36823?
CVE-2023-36823 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-36823?
Check the references section above for vendor advisories and patch information. Affected products include: Sanitize Project Sanitize, Debian Debian Linux.