CVE-2021-32696

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The npm package "striptags" is an implementation of PHP's strip_tags in Typescript. In striptags before version 3.2.0, a type-confusion vulnerability can cause `striptags` to concatenate unsanitized strings when an array-like object is passed in as the `html` parameter. This can be abused by an attacker who can control the shape of their input, e.g. if query parameters are passed directly into the function. This can lead to a XSS.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79 CWE-241 CWE-843

Affected software

No affected versions have been published.

Timeline

Published: Jun 18, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-326975.3neos/forms is an open source framework to build web forms. By crafting a special `GET` request containing a valid form state, a form can be CVE-2021-326984.9eLabFTW is an open source electronic lab notebook for research labs. This vulnerability allows an attacker to make GET requests on behalf of CVE-2021-326996.5Wings is the control plane software for the open source Pterodactyl game management system. All versions of Pterodactyl Wings prior to `1.4.CVE-2021-327007.4Ballerina is an open source programming language and platform for cloud application programmers. Ballerina versions 1.2.x and SL releases up CVE-2021-327017.5ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rul CVE-2021-327026.1The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including `1.4.1` are v CVE-2021-327035.3Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of rat CVE-2021-327048.8DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerabilit CVE-2021-327057.5Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of rat CVE-2021-327068.8Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web int CVE-2021-327074.3Nextcloud Mail is a mail app for Nextcloud. In versions prior to 1.9.6, the Nextcloud Mail application does not, by default, render images i CVE-2021-327088.1Flysystem is an open source file storage library for PHP. The whitespace normalisation using in 1.x and 2.x removes any unicode whitespace.