CVE-2024-21501: apostrophecms sanitize-html
Vulnerability summary
CVE-2024-21501 is a medium (CVSS 5.3) vulnerability in apostrophecms sanitize-html. EPSS estimates a 1.03% chance of exploitation in the next 30 days, higher than 63.2% of scored vulnerabilities. 3 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 24-02-2024PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · WolfiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P
- OSV · NpmEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
1.03%
Chance of exploitation in the next 30 days
Percentile
63%
Versus all other CVEs
30-day change
0.00 pp
From 1.03% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 found8B4D061Abe6Ee1B2E10C7242987674Cf
Maturity: poc
Exploit Reference (security.snyk.io)
Maturity: unknown
Exploit Reference (security.snyk.io)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-538Insertion of Sensitive Information into Externally-Accessible File or DirectoryThe product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.
Affected systems
Chainguard6 products
- jupyter-base-notebook< 7.6.3-r2
- py3.10-jupyterlab< 4.6.1-r1
- py3.11-jupyterlab< 4.6.1-r1
- py3.12-jupyterlab< 4.6.1-r1
- py3.13-jupyterlab< 4.6.1-r1
Wolfi5 products
- jupyter-base-notebook< 7.6.3-r2
- py3.10-jupyterlab< 4.6.1-r1
- py3.11-jupyterlab< 4.6.1-r1
- py3.12-jupyterlab< 4.6.1-r1
- py3.13-jupyterlab< 4.6.1-r1
Apostrophecms1 product
- sanitize-html< 2.12.1
Debian1 product
- node-sanitize-htmlAll versions (No fix recorded) | < 2.13.0+~2.11.0-1
Fedoraproject1 product
- fedoraEOL39 | 40
Npm1 product
- sanitize-html< 2.12.1
Ubuntu1 product
- node-sanitize-htmlAll versions (No fix recorded)
7 vendors · 16 products
