GHSA-vccv-cmxp-4j9h sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes
Summarysanitize-html uses `allowedSchemesAppliedToAttributes` (default: `['href', 'src', 'cite']`) to gate the `naughtyHref()` function that blocks dangerous URI schemes like `javascript:` and `vbscript:`. The HTML specification defines 10+ attributes that accept URIs (`action`, `formaction`, `data`, `poster`, `background`, `ping`, `xlink:href`, `dynsrc`, `lowsrc`), but none of these are included in the default gate list. When a developer allows any of these attributes in their configuration, `javascript:` URIs pass through completely unmodified, enabling XSS.The library has zero awareness of these URI-bearing attributes — none appear anywhere in the 854-line source file (verified by grep). No warning mechanism exists, and the README provides no security guidance about expanding `allowedSchemesAppliedToAttributes` when allowing form or media attributes.SeverityExploitation requires non-default configuration: the developer must explicitly allow a non-default tag (e.g., `form`) AND a non-default attribute (e.g., `action`). Default configuration is NOT vulnerable. However, this is a common configuration pattern for CMS platforms, form builders, and rich content editors.Affected VersionsAll versions of sanitize-html from v1.18.0 (which introduced `allowedSchemesAppliedToAttributes`) through at least v2.17.2. The default list has been `['href', 'src', 'cite']` since introduction and has never been expanded.Root Cause**File**: `index.js:329` (sanitize-html 2.10.0, confirmed same in 2.17.x)**Default list at line 829**:The `naughtyHref()` function (lines 627-667) correctly blocks `javascript:`, `vbscript:`, and other dangerous schemes. However, it has exactly 2 call sites in the entire codebase (lines 330 and 395), both inside the `indexOf` gate. There is no ungated path.When attribute name is `action`, `formaction`, `data`, `poster`, `background`, etc.:`indexOf('action')` returns `-1`The `if` block is skipped entirely`naughtyHref()` is never called`javascript:alert(1)` passes through unmodifiedThe `escapeHtml()` function at line 464 provides no defense — it only encodes `& < > "` characters, which are not present in `javascript:alert(1)`.**Data Flow**:Steps to Reproduce**Observed behavior**: `javascript:` preserved on `action`/`formaction`/`data` but correctly stripped on `href`.**Expected behavior**: `javascript:` should be stripped on ALL URI-bearing attributes, or at minimum, the library should warn developers when they allow URI-bearing attributes not covered by scheme validation.ImpactAn attacker can achieve XSS in applications that use sanitize-html with non-default configurations allowing URI-bearing attributes:`<form action="javascript:...">` — XSS on form submission (all modern browsers)`<button formaction="javascript:...">` — per-button XSS override (all modern browsers)`<object data="javascript:...">` — object load XSS (Chrome, Firefox)`<video poster="javascript:...">` — limited browser support but spec-valid**Common vulnerable configurations**:CMS platforms allowing form elements for user-generated contentForm builder applicationsRich text editors with extended tag allowlistsEmail template editors allowing media/embed tags**Mitigating factors**:Default configuration is NOT vulnerableRequires double opt-in: non-default tag + non-default attributeCSP `form-action` directive mitigates form-based vectorsDevelopers CAN manually add attributes to `allowedSchemesAppliedToAttributes`Remediation**Option 1 (Recommended)**: Expand the default `allowedSchemesAppliedToAttributes` list:**Option 2**: Apply `naughtyHref()` to ALL attributes by default (invert the gate logic).**Option 3**: Add a runtime warning when developers allow URI-bearing attributes not in `allowedSchemesAppliedToAttributes` (analogous to `vulnerableTags` warning for `script`/`style` at lines 124-129).ReporterKevin Lee (Changseon Lee)
OPCIA Corp. / PeanutAI Inc.
Seoul, South Korea
GitHub: crattack
CVSS v3.1 score: 5.4