{"id":"CVE-2016-1000237","published":"2020-01-23T14:21:28Z","modified":"2024-08-06T03:55:27Z","title":"sanitize-html before 1.4.3 has XSS","vendor":null,"product":null,"tier":"tail","description":{"text":"sanitize-html before 1.4.3 has XSS.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.0084,"percentile":0.57833,"provenance":"source"},"cwes":[],"references":[{"url":"https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000237.json","tags":["x_refsource_MISC"]},{"url":"https://nodesecurity.io/advisories/135","tags":["x_refsource_MISC"]}],"priority":{"score":11.6,"factors":[{"name":"EPSS percentile","points":11.57}]},"affected":[{"ecosystem":"npm","package":"sanitize-html","vulnerableRanges":["<1.4.3"],"patched":["1.4.3"],"from":["GHSA-3j7m-hmh3-9jmp"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-0361","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-sanitize-html-cve-2016-1000237","children":[{"from":"CVE-2016-1000237","to":"CVE-2021-26539","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["index.js"],"commits":["https://github.com/apostrophecms/sanitize-html/commit/762fbc7bba389f3f789cc291c1eb2b64f60f2caf","https://github.com/apostrophecms/sanitize-html/commit/bdf7836ef8f0e5b21f9a1aab0623ae8fcd09c1da"],"basis":"shared function","functions":["sanitizeHtml"]}]},{"from":"CVE-2016-1000237","to":"CVE-2022-25887","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["index.js"],"commits":["https://github.com/apostrophecms/sanitize-html/commit/762fbc7bba389f3f789cc291c1eb2b64f60f2caf","https://github.com/apostrophecms/sanitize-html/commit/b4682c12fd30e12e82fa2d9b766de91d7d2cd23c"],"basis":"shared function","functions":["sanitizeHtml"]}]},{"from":"CVE-2016-1000237","to":"CVE-2024-21501","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["index.js"],"commits":["https://github.com/apostrophecms/sanitize-html/commit/762fbc7bba389f3f789cc291c1eb2b64f60f2caf","https://github.com/apostrophecms/sanitize-html/commit/c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4"],"basis":"shared function","functions":["sanitizeHtml"]}]}],"packageHistory":[{"cve":"CVE-2017-16017","published":"2018-06-04","fixed":"1.2.3","kev":false,"link":{"from":"CVE-2017-16017","to":"CVE-2016-1000237","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:sanitize-html","fromFixed":"1.2.3","toFixed":"1.4.3","daysApart":598}]}},{"cve":"CVE-2016-1000237","published":"2020-01-23","fixed":"1.4.3","kev":false},{"cve":"CVE-2017-16016","published":"2018-06-04","fixed":"1.11.4","kev":false},{"cve":"CVE-2019-25225","published":"2025-09-08","fixed":"2.0.0-beta","kev":false},{"cve":"CVE-2021-26539","published":"2021-02-08","fixed":"2.3.1","kev":false}],"package":"npm:sanitize-html"}}