CVE-2023-36823

Summary

CVE-2023-36823 is a vulnerability in the Sanitize software, versions 3.0.0 to 6.0.2, that allows an attacker to bypass HTML and CSS sanitization when certain configurations are used. This can lead to cross-site scripting attacks or other undesired behavior when the malicious code is rendered in a browser. The vulnerability can be remediated by upgrading to version 6.0.2, which includes additional escaping of CSS in `style` element content. Alternatively, users can use a Sanitize configuration that disallows `style` elements or CSS at-rules, or manually escape the character sequence `</` as `<\/` in `style` element content. The vulnerability has a medium severity rating according to NIST and a high severity rating according to security advisories from GitHub, with a CVSS score of 6.1 and 7.1 respectively. The affected products include various versions of Sanitize as well as other related products, posing potential danger to organizations using these software components for HTML and CSS sanitization purposes.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.