CVE-2024-21501: Sanitize-html Information Disclosure Flaw

CVE-2024-21501 Overview

CVE-2024-21501 affects the sanitize-html package maintained by ApostropheCMS in all versions prior to 2.12.1. The vulnerability allows attackers to enumerate files on the server file system, including project dependencies, when the library is used on the backend with the style attribute allowed. The root cause lies in how the library invokes PostCSS to parse style attribute values, which generates source maps that reference file system paths. This flaw is categorized under CWE-200 (Information Exposure) and CWE-538 (File and Directory Information Exposure).

Critical Impact
Remote unauthenticated attackers can craft malicious HTML style attributes to enumerate server file system paths and reveal project dependency structures.

Affected Products

ApostropheCMS sanitize-html versions before 2.12.1 (Node.js)
Fedora 39
Fedora 40

Discovery Timeline

2024-02-24 - CVE-2024-21501 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21501

Vulnerability Analysis

The sanitize-html library sanitizes untrusted HTML on the server side, including inline CSS when parseStyleAttributes is enabled and style is present in allowedAttributes. To process CSS declarations, the library passes the attribute value to postcssParse from the PostCSS parser. By default, PostCSS generates an abstract syntax tree that includes source map annotations. These annotations can reference resolvable file paths on the host, which the library then serializes back into sanitized output.

An attacker who supplies crafted CSS containing sourceMappingURL directives or CSS import references can trigger PostCSS to resolve and embed file system information. The returned sanitized HTML therefore exposes internal server paths, project layout, and dependency locations to the requester.

Root Cause

The vulnerable call site invokes postcssParse(name + ' {' + value + '}') without disabling source map processing. PostCSS treats this input as parsable CSS and enriches the resulting AST with source map metadata derived from file paths. The stringifyStyleAttributes step then reflects that metadata back to the caller.

Attack Vector

Exploitation requires only that a backend service accept HTML input, sanitize it with the vulnerable library, and allow style attributes. The attacker submits an HTTP request carrying a payload that abuses PostCSS source map behavior. No authentication or user interaction is required, and the attack traverses the network without local access to the target.

javascript

// Security patch - sanitize-html index.js
            if (a === 'style') {
              if (options.parseStyleAttributes) {
                try {
-                  const abstractSyntaxTree = postcssParse(name + ' {' + value + '}');
+                  const abstractSyntaxTree = postcssParse(name + ' {' + value + '}', { map: false });
                  const filteredAST = filterCss(abstractSyntaxTree, options.allowedStyles);

                  value = stringifyStyleAttributes(filteredAST);

Source: ApostropheCMS sanitize-html patch commit. The fix passes { map: false } to postcssParse so source map generation is disabled and file paths are no longer embedded in the sanitized output.

Detection Methods for CVE-2024-21501

Indicators of Compromise

Inbound HTTP requests containing HTML style attributes with sourceMappingURL, @import, or unusual url() values targeting local paths.
Application responses that echo absolute file system paths such as /home/, /var/www/, /app/node_modules/, or Windows drive letters inside style attributes.
Presence of sanitize-html versions earlier than 2.12.1 in package-lock.json or yarn.lock on production services.

Detection Strategies

Perform a software composition analysis (SCA) scan of Node.js projects to enumerate all direct and transitive uses of sanitize-html below 2.12.1.
Add a Web Application Firewall (WAF) rule that flags requests where the style attribute contains sourceMappingURL tokens or references to filesystem-like paths.
Compare outbound HTTP response bodies against a baseline to detect leakage of absolute paths or dependency names in sanitized user content.

Monitoring Recommendations

Log and review inputs to any endpoint that persists user-supplied HTML, focusing on style attribute content.
Alert on responses containing directory strings that match known project structure (node_modules, source directories, build artifacts).
Track dependency drift over time and fail builds when vulnerable versions of sanitize-html are reintroduced.

How to Mitigate CVE-2024-21501

Immediate Actions Required

Upgrade sanitize-html to version 2.12.1 or later in every affected Node.js project and rebuild all artifacts.
Apply Fedora updates on Fedora 39 and Fedora 40 hosts that ship the vulnerable package.
Audit application code to determine whether style is in allowedAttributes and whether parseStyleAttributes is enabled.

Patch Information

The issue is resolved in sanitize-html 2.12.1 via pull request #650 and commit c5dbdf7. Fedora advisories are published in the Fedora 39 package announcement and the Fedora 40 package announcement. Additional details are documented in the Snyk JavaScript advisory and the Snyk Java WebJars advisory.

Workarounds

Disable style attribute processing by removing style from allowedAttributes if upgrading immediately is not possible.
Set parseStyleAttributes: false to bypass the PostCSS parsing code path that exposes source map data.
Restrict backend acceptance of user-supplied HTML to trusted contexts until the patched version is deployed.

bash

# Upgrade sanitize-html to the patched version
npm install sanitize-html@^2.12.1

# Verify installed version
npm ls sanitize-html

# Fedora hosts
sudo dnf update nodejs-sanitize-html