Cross-site Scripting (XSS)

Vulnerability

The package @braintree/sanitize-url versions before 6.0.0 contain a Cross-site Scripting (XSS) vulnerability in the sanitizeUrl function. The function fails to properly decode HTML entities before validating URLs, allowing attackers to bypass the sanitization logic using encoded JavaScript protocols [1][2][3].

Exploitation

An attacker can craft a URL with HTML-entity-encoded characters representing a javascript: protocol (e.g., &#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041). When passed to sanitizeUrl in affected versions, the function does not decode these entities, and the resulting string is treated as a safe URL, allowing the javascript: protocol to remain. If the sanitized URL is then rendered in a browser, the encoded script executes [2].

Impact

Successful exploitation leads to Cross-site Scripting (XSS). An attacker can execute arbitrary JavaScript in the context of the victim's browser session, potentially leading to data theft, session hijacking, or defacement [1][2].

Mitigation

Upgrade to version 6.0.0 or higher of @braintree/sanitize-url, which includes proper HTML entity decoding before sanitization [2][3]. No other workarounds have been published.