CVE-2019-10062

The HTMLSanitizer class in html-sanitizer.ts in all released versions of the Aurelia framework 1.x repository is vulnerable to XSS

published May 13, 2021

CVSS
—
EPSS
1%
Percentile
72.6
In the wild
Unconfirmed
What it is

The HTMLSanitizer class in html-sanitizer.ts in all released versions of the Aurelia framework 1.x repository is vulnerable to XSS. The sanitizer only attempts to filter SCRIPT elements, which makes it feasible for remote attackers to conduct XSS attacks via (for example) JavaScript code in an attribute of various other elements. An attacker might also exploit a bug in how the SCRIPT string is processed by splitting and nesting them for example.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01416 · 72.6th percentile
Published
2021-05-13T20:27Z
EPSS history
Timeline
  • 13 MAY 20:27Z
    The HTMLSanitizer class in html-sanitizer.ts in all released versions of the Aurelia framework 1.x repository is vulnerable to XSS
    cvelistv5