Description
html-janitor node module suffers from an External Control of Critical State Data vulnerability via user-control of the '_sanitized' variable causing sanitization to be bypassed.
Remediation
References
https://github.com/guardian/html-janitor/issues/35
https://hackerone.com/reports/308158
Related Vulnerabilities
CVE-2021-43466 Vulnerability in maven package org.thymeleaf:thymeleaf-spring5
CVE-2019-1010091 Vulnerability in maven package org.webjars.bower:tinymce
CVE-2017-1000048 Vulnerability in npm package qs
CVE-2022-0853 Vulnerability in maven package jboss:jboss-client
CVE-2022-1233 Vulnerability in maven package org.webjars.bower:urijs