Html-to-text is a Node.js package designed for developers needing to extract readable plain text from HTML documents. Version 2.1.2 introduces subtle refinements over its predecessor, version 2.1.1, primarily reflected in its release date and potentially some internal bug fixes or minor performance improvements. While the core dependencies, including "he" for HTML entity encoding/decoding, "htmlparser" for parsing HTML, "optimist" for command-line argument parsing, and "underscore" and "underscore.string" for utility functions, remain consistent, developers should note the updated release date suggesting a more recent build with likely bug fixes.
Both versions offer robust HTML conversion capabilities for applications like email processing, content summarization, or data extraction. They come equipped with development dependencies "chai" and "mocha" for testing, ensuring code stability. The package utilizes the MIT license, providing users with considerable freedom in how they incorporate the library into their projects. The package's repository is hosted on GitHub which is beneficial for developers who are seeking troubleshooting and issue resolution. Given identical declared dependencies, the upgrade from 2.1.1 to 2.1.2 is likely a low-risk enhancement, primarily delivering bug fixes that could improve stability and reliability within existing integrations. Developers integrating the tool should consider updating for the latest improvements.
All the vulnerabilities related to the version 2.1.2 of the package
Prototype Pollution in minimist
Affected versions of minimist are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --__proto__.y=Polluted adds a y property with value Polluted to all objects. The argument --__proto__=Polluted raises and uncaught error and crashes the application.
This is exploitable if attackers have control over the arguments being passed to minimist.
Upgrade to versions 0.2.1, 1.2.3 or later.
Prototype Pollution in minimist
Minimist prior to 1.2.6 and 0.2.4 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
