CVE-2021-42576 (High) detected in github.com/microcosm-cc/bluemonday-v1.0.5 - autoclosed

[mend-bolt-for-github[bot]]

CVE-2021-42576 - High Severity Vulnerability

Vulnerable Library - github.com/microcosm-cc/bluemonday-v1.0.5

bluemonday: a fast golang HTML sanitizer (inspired by the OWASP Java HTML Sanitizer) to scrub user generated content of XSS

Dependency Hierarchy: - :x: **github.com/microcosm-cc/bluemonday-v1.0.5** (Vulnerable Library)

Found in base branch: dev/seed-tool

Vulnerability Details

The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.

Publish Date: 2021-10-18

URL: CVE-2021-42576

CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42576

Release Date: 2021-10-18

Fix Resolution: bluemonday sanitizer - 1.0.16;pybluemonday - 0.0.8

---

Step up your Open Source Security Game with WhiteSource here

[mend-bolt-for-github[bot]]

:heavy_check_mark: This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.

[mend-bolt-for-github[bot]]

:heavy_check_mark: This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.