CVE-2021-23648

Cross-site Scripting (XSS)

5.4 MediumFix available

The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

1.43%Up 0.5 points since Mar 17, 2022

What each source reports

CVE List Score used 5.4

Cross-site Scripting (XSS)

The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function.

Record: CVE-2021-23648
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P
Updated: 2026-11-02

EUVDEUVD-2022-1445 5.4

The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function.

Record: EUVD-2022-1445
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P
Updated: 2026-11-03

GitHub AdvisoriesGHSA-hqq7-2q2v-82xq 5.4

Cross-site Scripting in sanitize-url

The package @braintree/sanitize-url before 6.0.0 is vulnerable to Cross-site Scripting (XSS) due to improper sanitization in the sanitizeUrl function.

Record: GHSA-hqq7-2q2v-82xq
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

NVD 5.4

The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function.

Record: CVE-2021-23648
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 6.1

The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function.

Record: CVE-2021-23648
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2021-23648 6.1

The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function.

Record: DEBIAN-CVE-2021-23648
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

Show 8 moreShow less

OSVGHSA-hqq7-2q2v-82xq 5.4

Cross-site Scripting in sanitize-url

The package @braintree/sanitize-url before 6.0.0 is vulnerable to Cross-site Scripting (XSS) due to improper sanitization in the sanitizeUrl function.

Record: GHSA-hqq7-2q2v-82xq
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVRHSA-2022:7519 7.5

Red Hat Security Advisory: grafana security, bug fix, and enhancement update

Record: RHSA-2022:7519
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2022:8057 7.5

Red Hat Security Advisory: grafana security, bug fix, and enhancement update

Record: RHSA-2022:8057
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRLSA-2022:7519 7.5

Moderate: grafana security, bug fix, and enhancement update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

The following packages have been upgraded to a later upstream version: grafana (7.5.15). (BZ#2055348)

Security Fix(es):

sanitize-url: XSS due to improper sanitization in sanitizeUrl function (CVE-2021-23648)
golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)
golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)
grafana: Forward OAuth Identity Token can allow users to access some data sources (CVE-2022-21673)
prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)
grafana: XSS vulnerability in data source handling (CVE-2022-21702)
grafana: CSRF vulnerability can lead to privilege escalation (CVE-2022-21703)
grafana: IDOR vulnerability can lead to information disclosure (CVE-2022-21713)
golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)
golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)
golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)
golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)
golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)
golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.

Record: RLSA-2022:7519
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRLSA-2022:8057 7.5

Important: grafana security, bug fix, and enhancement update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

The following packages have been upgraded to a later upstream version: grafana (7.5.15). (BZ#2055349)

Security Fix(es):

sanitize-url: XSS due to improper sanitization in sanitizeUrl function (CVE-2021-23648)
golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)
golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)
grafana: Forward OAuth Identity Token can allow users to access some data sources (CVE-2022-21673)
prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)
grafana: XSS vulnerability in data source handling (CVE-2022-21702)
grafana: CSRF vulnerability can lead to privilege escalation (CVE-2022-21703)
grafana: IDOR vulnerability can lead to information disclosure (CVE-2022-21713)
golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)
golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)
golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)
golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)
golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)
golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section.

Record: RLSA-2022:8057
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2021-23648 5.4

The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function.

Record: UBUNTU-CVE-2021-23648
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVALSA-2022:7519 No score

Moderate: grafana security, bug fix, and enhancement update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

The following packages have been upgraded to a later upstream version: grafana (7.5.15). (BZ#2055348)

Security Fix(es):

sanitize-url: XSS due to improper sanitization in sanitizeUrl function (CVE-2021-23648)
golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)
golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)
grafana: Forward OAuth Identity Token can allow users to access some data sources (CVE-2022-21673)
prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)
grafana: XSS vulnerability in data source handling (CVE-2022-21702)
grafana: CSRF vulnerability can lead to privilege escalation (CVE-2022-21703)
grafana: IDOR vulnerability can lead to information disclosure (CVE-2022-21713)
golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)
golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)
golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)
golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)
golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)
golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record: ALSA-2022:7519
Updated: 2026-11-02

OSVALSA-2022:8057 No score

Important: grafana security, bug fix, and enhancement update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

The following packages have been upgraded to a later upstream version: grafana (7.5.15). (BZ#2055349)

Security Fix(es):

sanitize-url: XSS due to improper sanitization in sanitizeUrl function (CVE-2021-23648)
golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)
golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)
grafana: Forward OAuth Identity Token can allow users to access some data sources (CVE-2022-21673)
prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)
grafana: XSS vulnerability in data source handling (CVE-2022-21702)
grafana: CSRF vulnerability can lead to privilege escalation (CVE-2022-21703)
grafana: IDOR vulnerability can lead to information disclosure (CVE-2022-21713)
golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)
golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)
golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)
golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)
golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)
golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record: ALSA-2022:8057
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`@braintree/sanitize-url` npm	before 6.0.0	6.0.0
`grafana` AlmaLinux:8	before 7.5.15-3.el8	7.5.15-3.el8
`grafana` AlmaLinux:9	before 7.5.15-3.el9	7.5.15-3.el9
`node-mermaid` Debian:14	before 8.14.0+~cs11.4.14-1, plus listed versions 8.11.0+ds+~cs29.13.22-18.13.2+ds+~cs30.13.21-18.13.2+ds+~cs30.13.21-1.18.13.3+ds+~cs26.13.21-18.13.3+ds+~cs26.13.21-2 Show 7 moreShow less 8.13.8+~cs10.4.16-18.7.0+ds+~cs27.17.17-18.7.0+ds+~cs27.17.17-28.7.0+ds+~cs27.17.17-2~bpo10+18.7.0+ds+~cs27.17.17-38.9.1+ds+~cs26.20.25-18.9.3+ds+~cs29.13.19-1	8.14.0+~cs11.4.14-1
`grafana` Red Hat:enterprise_linux:8::appstream	before 0:7.5.15-3.el8	0:7.5.15-3.el8
`grafana-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:7.5.15-3.el8	0:7.5.15-3.el8
`grafana` Red Hat:enterprise_linux:9::appstream	before 0:7.5.15-3.el9	0:7.5.15-3.el9
`grafana-debuginfo` Red Hat:enterprise_linux:9::appstream	before 0:7.5.15-3.el9	0:7.5.15-3.el9
`grafana` Rocky Linux:8	before 0:7.5.15-3.el8	0:7.5.15-3.el8
`grafana` Rocky Linux:9	before 0:7.5.15-3.el9	0:7.5.15-3.el9
`node-mermaid` Ubuntu:22.04:LTS	All versions, plus listed versions 8.7.0+ds+~cs27.17.17-38.13.3+ds+~cs26.13.21-18.13.3+ds+~cs26.13.21-28.13.8+~cs10.4.16-1	None known
`node-mermaid` Ubuntu:26.10	All versions, plus listed versions 9.2.2+~2.0.0-19.2.2+~2.0.0-2	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-23648 is a medium vulnerability (CVSS 5.4) in Fedoraproject Fedora, published March 16, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.43%, the 73rd percentile. Fixed in @braintree/sanitize-url 6.0.0.

References

Show 113 moreShow less