{"id":"GHSA-2v5f-23xc-v9qr","summary":"ansi_up cross-site scripting vulnerability","details":"The npm package ansi_up converts ANSI escape codes into HTML. In ansi_up v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, this feature is affected by a cross-site scripting (XSS) vulnerability. This issue is fixed in v5.0.0.","aliases":["CVE-2021-3377"],"modified":"2025-11-04T16:33:40Z","published":"2021-03-11T22:50:39Z","database_specific":{"github_reviewed_at":"2021-03-11T22:49:55Z","nvd_published_at":"2021-03-05T21:15:00Z","cwe_ids":["CWE-79"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3377"},{"type":"WEB","url":"https://github.com/drudru/ansi_up/commit/c8c726ed1db979bae4f257b7fa41775155ba2e27"},{"type":"WEB","url":"https://doyensec.com/resources/Doyensec_Advisory_ansi_up4_XSS.pdf"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20241108-0002"}],"affected":[{"package":{"name":"ansi_up","ecosystem":"npm","purl":"pkg:npm/ansi_up"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.0.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/03/GHSA-2v5f-23xc-v9qr/GHSA-2v5f-23xc-v9qr.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}