CVE-2023-23627

Sanitize is an allowlist-based HTML and CSS sanitizer. Versions 5.0.0 and later, prior to 6.0.1, are vulnerable to Cross-site Scripting. When Sanitize is configured with a custom allowlist that allows `noscript` elements, attackers are able to include arbitrary HTML, resulting in XSS (cross-site scripting) or other undesired behavior when that HTML is rendered in a browser. The default configurations do not allow `noscript` elements and are not vulnerable. This issue only affects users who are using a custom config that adds `noscript` to the element allowlist. This issue has been patched in version 6.0.1. Users who are unable to upgrade can prevent this issue by using one of Sanitize's default configs or by ensuring that their custom config does not include `noscript` in the element allowlist.

• CWE-79

• https://github.com/rgrove/sanitize/security/advisories/GHSA-fw3g-2h3j-qmm7Mitigation, Release Notes, Third Party Advisory
• https://github.com/rgrove/sanitize/security/advisories/GHSA-fw3g-2h3j-qmm7Mitigation, Release Notes, Third Party Advisory

Published

Jan 28, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-23621Discourse is an open-source discussion platform. Prior to ve…7.5
• CVE-2023-23622Discourse is an open-source discussion platform. Prior to ve…4.3
• CVE-2023-23623Electron is a framework which lets you write cross-platform …9.8
• CVE-2023-23624Discourse is an open-source discussion platform. Prior to ve…5.3
• CVE-2023-23625go-unixfs is an implementation of a unix-like filesystem on …7.5
• CVE-2023-23626go-bitfield is a simple bitfield package for the go language…7.5
• CVE-2023-23628Metabase is an open source data analytics platform. Affected…4.1
• CVE-2023-23629Metabase is an open source data analytics platform. Affected…6.3
• CVE-2023-2363A vulnerability, which was classified as critical, has been …9.8
• CVE-2023-23630Eta is an embedded JS templating engine that works inside No…6.1
• CVE-2023-23631github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that…7.5
• CVE-2023-23632BeyondTrust Privileged Remote Access (PRA) versions 22.2.x t…7.8