CVE-2024-21501
sanitize-html Information Exposure vulnerability
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.
- Record
CVE-2024-21501- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P - Weakness
- CWE-200, CWE-538
- Updated
- 2026-11-02
EUVDEUVD-2024-0719
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.
- Record
EUVD-2024-0719- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rm97-x556-q36h
sanitize-html Information Exposure vulnerability
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.
- Record
GHSA-rm97-x556-q36h- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200, CWE-538
- Updated
- 2026-11-02
NVD
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.
- Record
CVE-2024-21501- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200, CWE-538
- Updated
- 2026-11-02
OSV
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.
- Record
CVE-2024-21501- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-21501
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.
- Record
DEBIAN-CVE-2024-21501- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-rm97-x556-q36h
sanitize-html Information Exposure vulnerability
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.
- Record
GHSA-rm97-x556-q36h- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200, CWE-538
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-21501
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.
- Record
UBUNTU-CVE-2024-21501- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1776644763 No score
TuxCare security update for sanitize-html (3 CVEs)
TuxCare rebuilt sanitize-html to address 3 CVEs. Fixed in 1.27.5-tuxcare.2.
- Record
CLSA-2026-1776644763- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2024-21501 No score
CVE-2024-21501 in @rootio/sanitize-html - Patched by Root
Root has patched CVE-2024-21501 in the @rootio/sanitize-html package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2024-21501- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sanitize-htmlnpm |
before 2.12.1 | 2.12.1 |
sanitize-htmlTuxCare:npm From an advisory covering 3 CVEs |
1.27.5-tuxcare.0 up to 1.27.5-tuxcare.2, plus listed versions 1.27.51.27.5-tuxcare.1 |
1.27.5-tuxcare.2 |
node-sanitize-htmlDebian:12 |
All versions, plus listed versions 2.13.0+~2.11.0-12.13.1+~2.13.0-12.14.0+~2.13.0-12.17.0+~2.16.1-12.8.0+~2.6.2-1 |
None known |
node-sanitize-htmlDebian:13 |
before 2.13.0+~2.11.0-1 | 2.13.0+~2.11.0-1 |
node-sanitize-htmlDebian:14 |
before 2.13.0+~2.11.0-1 | 2.13.0+~2.11.0-1 |
@rootio/sanitize-htmlRoot:npm |
before 1.4.2-root.io.8 | 1.4.2-root.io.81.4.2-root.io.9 |
sanitize-htmlRoot:npm |
before 1.4.2-aikido.9 | 1.4.2-aikido.9 |
node-sanitize-htmlUbuntu:22.04:LTS |
All versions, plus listed versions 2.6.1-1 |
None known |
node-sanitize-htmlUbuntu:24.04:LTS |
All versions, plus listed versions 2.8.0+~2.6.2-1 |
None known |
node-sanitize-htmlUbuntu:25.10 |
All versions, plus listed versions 2.14.0+~2.13.0-1 |
None known |
node-sanitize-htmlUbuntu:26.10 |
All versions, plus listed versions 2.14.0+~2.13.0-12.17.0+~2.16.1-1 |
None known |
node-sanitize-htmlUbuntu:26.04:LTS |
All versions, plus listed versions 2.14.0+~2.13.0-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-21501 is a medium vulnerability (CVSS 5.3) in Apostrophecms Sanitize-html, published February 24, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.03%, the 63rd percentile. Fixed in sanitize-html 2.12.1.
References
security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-6256334
gist.github.com/Slonser/8b4d061abe6ee1b2e10c7242987674cf
github.com/apostrophecms/sanitize-html/pull/650
Show 11 moreShow less
lists.fedoraproject.org/archives/list/[email protected]/message/P4I5X6V3LYUNBMZ5YOW4BV427TH3IK4S
nvd.nist.gov/vuln/detail/CVE-2024-21501
security-tracker.debian.org/tracker/CVE-2024-21501
ubuntu.com/security/CVE-2024-21501
cve.org/CVERecord?id=CVE-2024-21501