Platform
nodejs
Component
striptags
Fixed in
3.2.1
3.2.0
CVE-2021-32696 describes a type-confusion vulnerability found in the striptags Node.js package. This flaw allows an attacker to potentially trigger cross-site scripting (XSS) by manipulating the input passed to the striptags function. The vulnerability affects versions prior to 3.2.0 and can be exploited if query parameters are directly passed into the function without proper sanitization. A fix is available in version 3.2.0.
The core impact of CVE-2021-32696 is the potential for cross-site scripting (XSS). An attacker can exploit this vulnerability by crafting malicious input that, when processed by striptags, results in the concatenation of unsanitized strings. This concatenated string can then be injected into a web page, allowing the attacker to execute arbitrary JavaScript code in the victim's browser. The attacker could steal session cookies, redirect users to phishing sites, or deface the website. The blast radius depends on the application's usage of striptags and the sensitivity of the data handled by the application. If user-supplied data is directly used in HTML output after being processed by striptags without proper escaping, the risk is significantly higher.
CVE-2021-32696 was publicly disclosed on June 18, 2021. There is no indication of active exploitation campaigns targeting this vulnerability. Public proof-of-concept exploits are available, demonstrating the feasibility of exploiting the type-confusion flaw. The vulnerability is not currently listed on the CISA KEV catalog. The LOW CVSS score reflects the relatively limited impact and ease of mitigation.
Exploit Status
EPSS
0.29% (53% percentile)
CVSS Vector
The primary mitigation for CVE-2021-32696 is to upgrade the striptags package to version 3.2.0 or later. This version includes a fix that addresses the type-confusion vulnerability. If upgrading is not immediately feasible, a workaround involves ensuring that the html parameter passed to the striptags function is always a string. This can be achieved by explicitly casting the input to a string before calling the function. Additionally, implement robust input validation and sanitization practices throughout your application to prevent the injection of malicious code. After upgrading, confirm the fix by attempting to trigger the vulnerability with crafted input and verifying that it is no longer exploitable.
Actualice la dependencia striptags a la versión 3.2.0 o superior. Esto solucionará la vulnerabilidad de confusión de tipos que puede llevar a XSS. Ejecute `npm install striptags@latest` o `yarn upgrade striptags@latest` para actualizar.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2021-32696 is a type-confusion vulnerability in the striptags Node.js package that can lead to XSS if an array-like object is passed as the 'html' parameter.
You are affected if you are using a version of striptags prior to 3.2.0 and are passing user-controlled data directly into the function without proper validation.
Upgrade the striptags package to version 3.2.0 or later. Alternatively, ensure the 'html' parameter is always a string before calling the function.
There is no current evidence of active exploitation campaigns targeting CVE-2021-32696, but public proof-of-concept exploits exist.
Refer to the striptags project's GitHub repository for details and updates: https://github.com/luxon/striptags/issues/71
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.