LiveActive security incident?Get immediate response
CVE Record

CVE-2023-36823: Sanitize vulnerable to Cross-site Scripting via insufficient neutralization of `style` element content

Sanitize is an allowlist-based HTML and CSS sanitizer. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML and CSS through Sanitize starting with version 3.0.0 and prior to version 6.0.2 when Sanitize is configured to use the built-in "relaxed" config or when using a custom config that allows `style` elements and one or more CSS at-rules. This could result in cross-site scripting or other undesired behavior when the malicious HTML and CSS are rendered in a browser. Sanitize 6.0.2 performs additional escaping of CSS in `style` element content, which fixes this issue. Users who are unable to upgrade can prevent this issue by using a Sanitize config that doesn't allow `style` elements, using a Sanitize config that doesn't allow CSS at-rules, or by manually escaping the character sequence `</` as `<\/` in `style` element content.

HighCVSS 7.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2023-36823 affects Sanitize, an HTML and CSS sanitizer. In specific configurations, malicious content could pass through filtering and execute in a user's browser. This matters most for applications that render user-supplied HTML sanitized by vulnerable Sanitize versions.

Executive priority

Prioritize remediation for public-facing applications that accept rich text or HTML from untrusted users. The issue enables browser-side code execution impact, but exposure depends on a specific sanitizer configuration.

Technical view

Sanitize versions 3.0.0 through before 6.0.2 insufficiently neutralize style element content when using the built-in relaxed configuration or custom configurations allowing style elements and CSS at-rules. The issue is CWE-79 cross-site scripting with CVSS 3.1 score 7.1.

Likely exposure

Exposure is limited to applications using affected Sanitize versions and configurations that allow style elements plus CSS at-rules, including the relaxed config. Systems not rendering attacker-controlled sanitized HTML are less likely exposed.

Exploitation context

The bundle does not show CISA KEV listing or confirmed active exploitation. The advisory describes crafted input causing arbitrary HTML and CSS to pass through and execute when rendered, requiring user interaction per the CVSS vector.

Researcher notes

Focus review on sanitizer policy, not only package presence. The critical condition is vulnerable Sanitize plus style elements and at-rules. The provided sources name 6.0.2 as the fixed release and describe configuration-based mitigations.

Mitigation direction

  • Upgrade Sanitize to version 6.0.2 or later.
  • Disable style elements in Sanitize configurations where possible.
  • Disable CSS at-rules if style elements must remain allowed.
  • If unable to upgrade, escape </ as <\/ inside style element content.
  • Check vendor or distribution guidance for packaged Sanitize deployments.

Validation and detection

  • Inventory applications and dependencies using rgrove Sanitize.
  • Confirm installed Sanitize versions are not >=3.0.0 and <6.0.2.
  • Review sanitizer configs for relaxed mode, style elements, and CSS at-rules.
  • Identify routes rendering user-supplied sanitized HTML in browsers.
  • Verify tests cover hostile style content handling after remediation.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-79: User-session and phishing behavior lookup

Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2023-36823 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.1CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L2.83.7Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

7.1High
CVSS 3.1 vector shape for CVE-2023-36823Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
rgrovesanitize>= 3.0.0, < 6.0.2Listed
Weakness

CWE details

CWE-79

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-79 · source CWE mapping

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs