GHSA-5p28-63mc-cgr9: 
JavaScript vulnerability analysis and mitigation

A high-severity Cross-Site Scripting (XSS) vulnerability was identified in the html-purify npm package, tracked as GHSA-5p28-63mc-cgr9. The vulnerability affects all versions up to and including 1.1.0, with its discovery and disclosure occurring on December 4, 2020. The vulnerability was last updated in the GitHub Advisory Database on January 9, 2023 (GitHub Advisory).

The vulnerability stems from improper sanitization of the data attribute within object tags, which allows javascript URIs to be processed, potentially leading to code execution. The issue is classified under CWE-79 (Cross-site Scripting) and has been assigned a high severity rating (GitHub Advisory, NPM Advisory).

When exploited, this vulnerability could allow attackers to execute arbitrary JavaScript code in the context of the affected application, potentially leading to unauthorized access to sensitive information or manipulation of web content (GitHub Advisory).

The vulnerability can be exploited through the manipulation of object tags' data attributes, as the sanitization mechanism can be bypassed to inject malicious JavaScript URIs (GitHub Advisory).

No official patch or fix is currently available for this vulnerability. Users are advised to consider using alternative HTML sanitization packages until a fix is made available (GitHub Advisory).