CVE-2019-10062

The HTMLSanitizer class in html-sanitizer.ts in all released versions of the Aurelia framework 1.x repository is vulnerable to XSS. The sanitizer only attempts to filter SCRIPT elements, which makes it feasible for remote attackers to conduct XSS attacks via (for example) JavaScript code in an attribute of various other elements. An attacker might also exploit a bug in how the SCRIPT string is processed by splitting and nesting them for example.

• CWE-79

• https://aurelia.ioVendor Advisory
• https://github.com/aurelia/templating-resources/blob/0cef07a8cac8e99146d8e1c4b734491bb3dc4724/src/html-sanitizer.jsThird Party Advisory
• https://www.gosecure.net/blog/2021/05/12/aurelia-framework-insecure-default-allows-xss/Exploit, Mitigation, Third Party Advisory
• https://aurelia.ioVendor Advisory
• https://github.com/aurelia/templating-resources/blob/0cef07a8cac8e99146d8e1c4b734491bb3dc4724/src/html-sanitizer.jsThird Party Advisory
• https://www.gosecure.net/blog/2021/05/12/aurelia-framework-insecure-default-allows-xss/Exploit, Mitigation, Third Party Advisory

Published

May 13, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-10057Various Lexmark products have CSRF.
• CVE-2019-10058Various Lexmark products have Incorrect Access Control.
• CVE-2019-10059The legacy finger service (TCP port 79) is enabled by defaul…
• CVE-2019-1006An authentication bypass vulnerability exists in Windows Com…
• CVE-2019-10060The Verix Multi-app Conductor application 2.7 for Verifone V…
• CVE-2019-10061utils/find-opencv.js in node-opencv (aka OpenCV bindings for…
• CVE-2019-10063Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.…
• CVE-2019-10064hostapd before 2.6, in EAP mode, makes calls to the rand() a…7.5
• CVE-2019-10065An issue was discovered in Open Ticket Request System (OTRS)…4.3
• CVE-2019-10066An issue was discovered in Open Ticket Request System (OTRS)…
• CVE-2019-10067An issue was discovered in Open Ticket Request System (OTRS)…5.4
• CVE-2019-10068An issue was discovered in Kentico 12.0.x before 12.0.15, 11…9.8