{"id":"GHSA-qxg5-2qff-p49r","summary":"Passing in a non-string 'html' argument can lead to unsanitized output","details":"A type-confusion vulnerability can cause `striptags` to concatenate unsanitized strings when an array-like object is passed in as the `html` parameter. This can be abused by an attacker who can control the shape of their input, e.g. if query parameters are passed directly into the function.\n\n### Impact\n\nXSS\n\n### Patches\n\n`3.2.0`\n\n### Workarounds\n\nEnsure that the `html` parameter is a string before calling the function.\n","aliases":["CVE-2021-32696"],"modified":"2026-05-07T05:02:58.942697768Z","published":"2021-06-18T19:31:35Z","database_specific":{"github_reviewed_at":"2021-06-18T19:31:21Z","nvd_published_at":"2021-06-18T20:15:00Z","cwe_ids":["CWE-241","CWE-79","CWE-843"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/ericnorris/striptags/security/advisories/GHSA-qxg5-2qff-p49r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32696"},{"type":"WEB","url":"https://github.com/ericnorris/striptags/commit/f252a6b0819499cd65403707ebaf5cc925f2faca"},{"type":"WEB","url":"https://github.com/ericnorris/striptags/releases/tag/v3.2.0"},{"type":"WEB","url":"https://www.npmjs.com/package/striptags"}],"affected":[{"package":{"name":"striptags","ecosystem":"npm","purl":"pkg:npm/striptags"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.2.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/06/GHSA-qxg5-2qff-p49r/GHSA-qxg5-2qff-p49r.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}