CVE-2021-3377

Summary

CVE	CVE-2021-3377
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2021-03-05 21:15:00 UTC
Updated	2021-03-09 15:46:00 UTC
Description	The npm package ansi_up converts ANSI escape codes into HTML. In ansi_up v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, this feature is affected by a cross-site scripting (XSS) vulnerability. This issue is fixed in v5.0.0.

Risk And Classification

Problem Types: CWE-79

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Ansi Up Project	Ansi Up	All	All	All	All
Application	Ansi Up Project	Ansi Up	All	All	All	All

References

Reference	Source	Link	Tags
doyensec.com/resources/Doyensec_Advisory_ansi_up4_XSS.pdf	MISC	doyensec.com	Exploit, Third Party Advisory
5.0.0 - Security fix. · drudru/ansi_up@c8c726e · GitHub	MISC	github.com	Patch, Third Party Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

179671 Debian Security Update for node-ansi-up (CVE-2021-3377)
982921 Nodejs (npm) Security Update for ansi_up (GHSA-2v5f-23xc-v9qr)