What’s Vulnerable › Vulnerabilities

CVE-2021-23648: Cross-site Scripting (XSS)

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-03-16 · updated 2026-06-17
• Weakness: CWE-79

Description

The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function.

Affected products

• Fedoraproject Fedora: 34, 35, 36
• PayPal Braintree/Sanitize-Url: before 6.0.0 — fixed in 6.0.0

How to fix

Upgrade to a fixed version: PayPal Braintree/Sanitize-Url 6.0.0. Check the vendor advisory for mitigations.

References

• https://github.com/braintree/sanitize-url/blob/main/src/index.ts%23L11
• https://github.com/braintree/sanitize-url/pull/40
• https://github.com/braintree/sanitize-url/pull/40/commits/e5afda45d9833682b705f73fc2c1265d34832183
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ/
• https://snyk.io/vuln/SNYK-JS-BRAINTREESANITIZEURL-2339882
• https://github.com/braintree/sanitize-url/blob/main/src/index.ts%23L11
• https://github.com/braintree/sanitize-url/pull/40
• https://github.com/braintree/sanitize-url/pull/40/commits/e5afda45d9833682b705f73fc2c1265d34832183
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH/

Get alerted when CVE-2021-23648 or the next vulnerability affects your stack