html_sanitize_ex vulnerabilities (Hex)
6 vulnerabilities.
-
html_sanitize_exHex Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of service 8.2 High -
html_sanitize_exHex Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service 8.2 High -
html_sanitize_exHex CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input 2.3 Low -
html_sanitize_exHex html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection 2.3 Low -
html_sanitize_exHex html_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allowing form hijacking 4.8 Medium -
html_sanitize_exHex html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding 2.3 Low