CVE-2021-23648

npm/@braintree/sanitize-url CVE-2021-23648: medium 5.4, EPSS 1.43%

Cross-site Scripting in sanitize-url

Action: Upgrade @braintree/sanitize-url to 6.0.0 or later.

npm i @braintree/sanitize-url@6.0.0

Affected

Fixed versions

Sources

• osv: GHSA-hqq7-2q2v-82xq
• https://nvd.nist.gov/vuln/detail/CVE-2021-23648
• https://github.com/braintree/sanitize-url/pull/40
• https://github.com/braintree/sanitize-url/pull/40/commits/e5afda45d9833682b705f73fc2c1265d34832183
• https://github.com/braintree/sanitize-url
• https://github.com/braintree/sanitize-url/blob/main/src/index.ts%23L11
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ
• https://snyk.io/vuln/SNYK-JS-BRAINTREESANITIZEURL-2339882

CVE-2021-23648 · published 2022-03-17T00:00:24Z · modified 2026-09-10T03:49:17.446984712Z · JSON