CVE-2021-32696: 
JavaScript vulnerability analysis and mitigation

CVE-2021-32696 affects the npm package 'striptags', an implementation of PHP's strip_tags in TypeScript. The vulnerability was discovered in versions before 3.2.0 and was disclosed on June 18, 2021. The issue affects applications using striptags for HTML sanitization, particularly when handling user-controlled input (GitHub Advisory, NVD).

The vulnerability is a type-confusion issue that occurs when an array-like object is passed as the 'html' parameter instead of a string. This confusion causes the function to concatenate unsanitized strings, potentially leading to cross-site scripting (XSS) attacks. The vulnerability has a CVSS v3.1 base score of 5.3 (MEDIUM) according to NVD, with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (NVD).

The primary impact of this vulnerability is the potential for cross-site scripting (XSS) attacks. When an attacker can control the shape of their input, such as when query parameters are passed directly into the function, they can bypass the intended HTML sanitization and inject malicious scripts (GitHub Advisory).

The vulnerability can be exploited when an attacker has control over the input passed to the striptags function and can provide an array-like object instead of a string. This is particularly relevant in web applications where user input from query parameters might be passed directly to the function without proper type checking (GitHub Lab).

The vulnerability was patched in version 3.2.0 of the striptags package. The fix involves adding type checking to ensure the 'html' parameter is a string before processing. For users unable to upgrade immediately, a workaround is to ensure that the html parameter is explicitly converted to a string before calling the function (GitHub Advisory).