Security readout for executives and security teams
Plain-English summary
Older sanitize-html versions could let unsafe links slip through filtering. If an application trusted this library to clean user-submitted HTML, a crafted link might run script in another user’s browser. Business impact is mainly account/session exposure or content tampering where users view attacker-controlled content.
Executive priority
Prioritize remediation where user-generated HTML is displayed to customers, administrators, or authenticated users. For internal-only or unused sanitization paths, schedule through normal dependency patching.
Technical view
CVE-2014-125128 is a CWE-79 XSS in sanitize-html before 1.0.3. The naughtyHref function did not properly validate anchor href attributes, allowing bypasses using case changes, whitespace, or hexadecimal encodings. CVSS 3.1 is 6.1: network-reachable, low complexity, no privileges, user interaction required, changed scope.
Likely exposure
Exposure is most likely in web applications using sanitize-html before 1.0.3 to process untrusted HTML containing links. Risk depends on whether sanitized output is rendered to other users in browsers.
Exploitation context
The bundle cites a public proof-of-concept repository, but KEV is false and no active exploitation source is provided. Treat this as publicly documented and testable, not confirmed exploited in the wild.
Researcher notes
The available evidence identifies the vulnerable function and bypass classes, plus patch commits. It does not provide confirmed exploitation telemetry, affected downstream applications, or detailed operational mitigations beyond updating the package.
Mitigation direction
- Upgrade sanitize-html to version 1.0.3 or later.
- Confirm lockfiles and deployed artifacts use the fixed version.
- Check vendor guidance and patch commits for project-specific notes.
- Add regression tests for href sanitization edge cases.
- Review stored user HTML created before remediation.
Validation and detection
- Inventory direct and transitive sanitize-html dependencies.
- Review SBOM, package manifests, and lockfiles for versions before 1.0.3.
- Identify routes rendering sanitized user-provided HTML.
- Verify tests cover href casing, whitespace, and encoded variants.
- Confirm deployed builds include the remediated dependency.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2014-125128 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N2.82.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.1MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/apostrophecms/sanitize-html/issues/1CVE reference · issue-tracking
- https://github.com/apostrophecms/sanitize-html/commit/889d4ec968e175f1905b2eb9d33f1fa89217cb02CVE reference · patch
- https://github.com/apostrophecms/sanitize-html/commit/423b90e06e1e85245eccedaabeb3a82840c6cd86CVE reference · patch
- https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2014/CVE-2014-125128CVE reference · exploit
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.