cloudflare/lol-html · Security
lol-html panics on certain HTML inputs
- GHSA ID
- GHSA-c3x7-354f-4p2x
- CVE ID
- CVE-2023-4241
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
Impact
lol-html can cause panics on certain HTML inputs. Anyone processing arbitrary 3rd party HTML with the library is affected.
Patches
The problem has been patched and released as v1.1.1
Workarounds
No workarounds exist.
CWEs
- CWE-20 · Improper Input Validation