| id: GO-2022-0762 |
| modules: |
| - module: github.com/microcosm-cc/bluemonday |
| versions: |
| - fixed: 1.0.5 |
| vulnerable_at: 1.0.4 |
| packages: |
| - package: github.com/microcosm-cc/bluemonday |
| symbols: |
| - Policy.sanitize |
| derived_symbols: |
| - Policy.Sanitize |
| - Policy.SanitizeBytes |
| - Policy.SanitizeReader |
| summary: |- |
| Cross-site scripting due to incorrect sanitization in |
| github.com/microcosm-cc/bluemonday |
| description: |- |
| An XSS injection was possible because the sanitization of the Cyrillic character |
| i bypass a protection mechanism against user-inputted HTML elements such as the |
| <script> tag. |
| published: 2021-05-18T21:07:37Z |
| cves: |
| - CVE-2021-29272 |
| ghsas: |
| - GHSA-3x58-xr87-2fcj |
| references: |
| - fix: https://github.com/microcosm-cc/bluemonday/commit/524f142fe46e945b7dcd291d7805c4b7dcf75bee |
| - web: https://github.com/microcosm-cc/bluemonday/issues/111 |
| - web: https://github.com/microcosm-cc/bluemonday/releases/tag/v1.0.5 |
| review_status: REVIEWED |
