CVE-2021-26540

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with "/\\example.com".

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://advisory.checkmarx.net/advisory/CX-2021-4309Exploit, Patch, Third Party Advisory
https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#232-2021-01-26Release Notes, Third Party Advisory
https://github.com/apostrophecms/sanitize-html/pull/460Patch, Third Party Advisory
https://advisory.checkmarx.net/advisory/CX-2021-4309Exploit, Patch, Third Party Advisory
https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#232-2021-01-26Release Notes, Third Party Advisory
https://github.com/apostrophecms/sanitize-html/pull/460Patch, Third Party Advisory

Timeline

Published: Feb 8, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-265419.8The gitlog function in src/index.ts in gitlog before 4.0.4 has a command injection vulnerability.CVE-2021-265438.8The "gitDiff" function in Wayfair git-parse <=1.0.4 has a command injection vulnerability. Clients of the git-parse library are unlikely to CVE-2021-265445.4Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use th CVE-2021-265495.4An XSS issue was discovered in SmartFoxServer 2.17.0. Input passed to the AdminTool console is not properly sanitized before being returned CVE-2021-265505.5An issue was discovered in SmartFoxServer 2.17.0. Cleartext password disclosure can occur via /config/server.xml.CVE-2021-265518.8An issue was discovered in SmartFoxServer 2.17.0. An attacker can execute arbitrary Python code, and bypass the javashell.py protection mech CVE-2021-265567.8When Octopus Server is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user us CVE-2021-265577.8When Octopus Tentacle is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user CVE-2021-265587.5Deserialization of Untrusted Data vulnerability of Apache ShardingSphere-UI allows an attacker to inject outer link resources. This issue af CVE-2021-265596.5Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow CVE-2021-265607.4Cleartext transmission of sensitive information vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426 CVE-2021-265618.1Stack-based buffer overflow vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the