CVE-2021-23648

Description

The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function.

How to fix CVE-2021-23648

To remediate CVE-2021-23648, upgrade the affected package to a fixed version below.

• Debian/node-mermaid—upgrade to 8.7.0+ds+~cs27.17.17-3+deb11u1 or later
• —upgrade to 6.0.0 or later

Is CVE-2021-23648 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 8.7.0+ds+~cs27.17.17-3+deb11u1
• from 0, < 6.0.0

CVSS scores

References (10)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-23648
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2021-23648
• PATCHgithub.com/braintree/sanitize-url
• WEBgithub.com/braintree/sanitize-url/blob/main/src/index.ts%23L11
• WEB