Das Übergeben eines nicht-String-Arguments 'html' kann zu nicht bereinigter Ausgabe führen

The core impact of CVE-2021-32696 is the potential for cross-site scripting (XSS). An attacker can exploit this vulnerability by crafting malicious input that, when processed by striptags, results in the concatenation of unsanitized strings. This concatenated string can then be injected into a web page, allowing the attacker to execute arbitrary JavaScript code in the victim's browser. The attacker could steal session cookies, redirect users to phishing sites, or deface the website. The blast radius depends on the application's usage of striptags and the sensitivity of the data handled by the application. If user-supplied data is directly used in HTML output after being processed by striptags without proper escaping, the risk is significantly higher.

Applications that rely on the striptags Node.js package for sanitizing HTML input are at risk. This includes web applications that accept user-provided HTML content, such as forums, blog comment systems, or content management systems. Specifically, applications that directly use the output of striptags in HTML without further escaping are particularly vulnerable.

• nodejs / server:

  npm list striptags

This command will list installed versions of striptags. Check if the version is less than 3.2.0. • nodejs / server:

  grep -r 'striptags(' /path/to/your/app

Search your codebase for calls to the striptags function. Review these calls to ensure proper input validation. • generic web: Review application logs for unusual patterns or errors related to the striptags package. Look for instances where user-supplied data is directly injected into HTML output.

1. 2021-06-18Disclosure

   disclosure

1. Reserviert2021-05-12
2. Veröffentlicht2021-06-18
3. Geändert2026-03-13
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2021-32696 is to upgrade the striptags package to version 3.2.0 or later. This version includes a fix that addresses the type-confusion vulnerability. If upgrading is not immediately feasible, a workaround involves ensuring that the html parameter passed to the striptags function is always a string. This can be achieved by explicitly casting the input to a string before calling the function. Additionally, implement robust input validation and sanitization practices throughout your application to prevent the injection of malicious code. After upgrading, confirm the fix by attempting to trigger the vulnerability with crafted input and verifying that it is no longer exploitable.