Unrated severityNVD Advisory· Published Sep 8, 2025· Updated Sep 8, 2025
CVE-2014-125128
CVE-2014-125128
Description
'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS). The function 'naughtyHref' doesn't properly validate the hyperreference (href) attribute in anchor tags (<a>), allowing bypasses that contain different casings, whitespace characters, or hexadecimal encodings.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- github.com/apostrophecms/sanitize-html/commit/423b90e06e1e85245eccedaabeb3a82840c6cd86mitrepatch
- github.com/apostrophecms/sanitize-html/commit/889d4ec968e175f1905b2eb9d33f1fa89217cb02mitrepatch
- github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2014/CVE-2014-125128mitreexploit
- github.com/apostrophecms/sanitize-html/issues/1mitreissue-tracking
News mentions
0No linked articles in our index yet.