CVE-2021-32696

The npm package "striptags" is an implementation of PHP's strip_tags in Typescript. In striptags before version 3.2.0, a type-confusion vulnerability can cause `striptags` to concatenate unsanitized strings when an array-like object is passed in as the `html` parameter. This can be abused by an attacker who can control the shape of their input, e.g. if query parameters are passed directly into the function. This can lead to a XSS.

• CWE-79
• CWE-241
• CWE-843

• https://github.com/ericnorris/striptags/commit/f252a6b0819499cd65403707ebaf5cc925f2facaPatch, Third Party Advisory
• https://github.com/ericnorris/striptags/releases/tag/v3.2.0Third Party Advisory
• https://github.com/ericnorris/striptags/security/advisories/GHSA-qxg5-2qff-p49rThird Party Advisory
• https://www.npmjs.com/package/striptagsProduct, Third Party Advisory
• https://github.com/ericnorris/striptags/commit/f252a6b0819499cd65403707ebaf5cc925f2facaPatch, Third Party Advisory
• https://github.com/ericnorris/striptags/releases/tag/v3.2.0Third Party Advisory
• https://github.com/ericnorris/striptags/security/advisories/GHSA-qxg5-2qff-p49rThird Party Advisory
• https://www.npmjs.com/package/striptagsProduct, Third Party Advisory

Published

Jun 18, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32690Helm is a tool for managing Charts (packages of pre-configur…8.6
• CVE-2021-32691Apollos Apps is an open source platform for launching church…9.8
• CVE-2021-32692Activity Watch is a free and open-source automated time trac…9.6
• CVE-2021-32693Symfony is a PHP framework for web and console applications …8.8
• CVE-2021-32694Nextcloud Android app is the Android client for Nextcloud. I…5.5
• CVE-2021-32695Nextcloud Android app is the Android client for Nextcloud. I…3.3
• CVE-2021-32697neos/forms is an open source framework to build web forms. B…5.3
• CVE-2021-32698eLabFTW is an open source electronic lab notebook for resear…4.9
• CVE-2021-32699Wings is the control plane software for the open source Pter…6.5
• CVE-2021-32700Ballerina is an open source programming language and platfor…7.4
• CVE-2021-32701ORY Oathkeeper is an Identity & Access Proxy (IAP) and Acces…7.5
• CVE-2021-32702The Auth0 Next.js SDK is a library for implementing user aut…6.1