https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 13:34:01 +0000 https://cve.radiocsirt.org/vuln/bdu:2021-03269 bdu:2021-03269 https://cve.radiocsirt.org/vuln/bdu:2021-03269 https://cve.radiocsirt.org/vuln/euvd-2026-28043 EUVD-2026-28043 https://cve.radiocsirt.org/vuln/euvd-2026-28043 https://cve.radiocsirt.org/vuln/fkie_cve-2021-32696 <p>The npm package &#34;striptags&#34; is an implementation of PHP&#39;s strip_tags in Typescript. In striptags before version 3.2.0, a type-confusion vulnerability can cause `striptags` to concatenate unsanitized strings when an array-like object is passed in as the `html` parameter. This can be abused by an attacker who can control the shape of their input, e.g. if query parameters are passed directly into the function. This can lead to a XSS.</p> <p>The npm package &#34;striptags&#34; is an implementation of PHP&#39;s strip_tags in Typescript. In striptags before version 3.2.0, a type-confusion vulnerability can cause `striptags` to concatenate unsanitized strings when an array-like object is passed in as the `html` parameter. This can be abused by an attacker who can control the shape of their input, e.g. if query parameters are passed directly into the function. This can lead to a XSS.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-32696 https://cve.radiocsirt.org/vuln/ghsa-qxg5-2qff-p49r <p><strong>Affected:</strong> npm: striptags</p> <p>A type-confusion vulnerability can cause `striptags` to concatenate unsanitized strings when an array-like object is passed in as the `html` parameter. This can be abused by an attacker who can control the shape of their input, e.g. if query parameters are passed directly into the function.</p> <p>### Impact</p> <p>XSS</p> <p>### Patches</p> <p>`3.2.0`</p> <p>### Workarounds</p> <p>Ensure that the `html` parameter is a string before calling the function.</p> <p><strong>Affected:</strong> npm: striptags</p> <p>A type-confusion vulnerability can cause `striptags` to concatenate unsanitized strings when an array-like object is passed in as the `html` parameter. This can be abused by an attacker who can control the shape of their input, e.g. if query parameters are passed directly into the function.</p> <p>### Impact</p> <p>XSS</p> <p>### Patches</p> <p>`3.2.0`</p> <p>### Workarounds</p> <p>Ensure that the `html` parameter is a string before calling the function.</p> https://cve.radiocsirt.org/vuln/ghsa-qxg5-2qff-p49r https://cve.radiocsirt.org/vuln/gsd-2021-32696 gsd-2021-32696 https://cve.radiocsirt.org/vuln/gsd-2021-32696