medium6.1
CVE-2021-3377
ansi_up cross-site scripting vulnerability
Impact
The npm package ansi_up converts ANSI escape codes into HTML. In ansi_up v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, this feature is affected by a cross-site scripting (XSS) vulnerability. This issue is fixed in v5.0.0.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | ansi_up | < 5.0.0 | 5.0.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ansi Up Project | Ansi Up | before 5.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://doyensec.com/resources/Doyensec_Advisory_ansi_up4_XSS.pdf
- https://github.com/drudru/ansi_up/commit/c8c726ed1db979bae4f257b7fa41775155ba2e27
- https://security.netapp.com/advisory/ntap-20241108-0002/
- https://github.com/advisories/GHSA-2v5f-23xc-v9qr
- https://nvd.nist.gov/vuln/detail/CVE-2021-3377
- https://security.netapp.com/advisory/ntap-20241108-0002