The html-to-text npm package offers a robust solution for converting HTML content into plain text, a common requirement in scenarios like email processing, creating text-based previews, or extracting content for indexing. Examining versions 2.1.0 and 2.1.1 reveals a subtle but potentially important distinction in their dependencies. The core functionality remains consistent between the two, indicated by shared dependencies like htmlparser, optimist, underscore, and underscore.string. Developers familiar with the package will find the upgrade to 2.1.1 seamless in terms of the primary API.
The key difference lies in the he (HTML entities) dependency. Version 2.1.0 relies on he version ^0.5.0, while version 2.1.1 bumps this up to ^1.0.0. This seemingly minor change could be significant. Updates to the he package likely involve improvements in HTML entity decoding, addressing potential bugs, enhancing security, or expanding supported character sets. Developers handling diverse or potentially untrusted HTML sources should strongly consider upgrading to 2.1.1 for these enhanced entity handling capabilities. Existing users should test the new version to ensure that their application logic doesn't depend on old implementation details of he package. Ultimately, while html-to-text 2.1.0 provides stable HTML to text conversion, those seeking the most up-to-date and secure HTML entity decoding should opt for 2.1.1.
All the vulnerabilities related to the version 2.1.1 of the package
Prototype Pollution in minimist
Affected versions of minimist are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --__proto__.y=Polluted adds a y property with value Polluted to all objects. The argument --__proto__=Polluted raises and uncaught error and crashes the application.
This is exploitable if attackers have control over the arguments being passed to minimist.
Upgrade to versions 0.2.1, 1.2.3 or later.
Prototype Pollution in minimist
Minimist prior to 1.2.6 and 0.2.4 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
