Description
The npm package ansi_up converts ANSI escape codes into HTML. In ansi_up v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, this feature is affected by a cross-site scripting (XSS) vulnerability. This issue is fixed in v5.0.0.
Remediation
References
https://github.com/drudru/ansi_up/commit/c8c726ed1db979bae4f257b7fa41775155ba2e27
https://doyensec.com/resources/Doyensec_Advisory_ansi_up4_XSS.pdf
Related Vulnerabilities
CVE-2020-36049 Vulnerability in maven package org.webjars.npm:socket.io-parser
CVE-2023-46502 Vulnerability in maven package org.opencrx:opencrx-core
CVE-2023-36820 Vulnerability in maven package io.micronaut.security:micronaut-security-oauth2
CVE-2021-43812 Vulnerability in npm package @auth0/nextjs-auth0
CVE-2022-23496 Vulnerability in maven package nl.basjes.parse.useragent:yauaa-parent