Description
html-janitor node module suffers from an External Control of Critical State Data vulnerability via user-control of the '_sanitized' variable causing sanitization to be bypassed.
Remediation
References
https://github.com/guardian/html-janitor/issues/35
https://hackerone.com/reports/308158
Related Vulnerabilities
CVE-2021-23495 Vulnerability in npm package karma
CVE-2019-19771 Vulnerability in npm package sb58
CVE-2022-45400 Vulnerability in maven package org.jvnet.hudson.plugins:japex
CVE-2023-37944 Vulnerability in maven package org.datadog.jenkins.plugins:datadog
CVE-2022-43423 Vulnerability in maven package com.compuware.jenkins:compuware-scm-downloader