To remediate this vulnerability, upgrade sanitize-html to version 2.12.1 or higher. Therefore, the fix is relatively straight-forward and is applicable to any OS of choice (Linux/Windows/MacOS): # Upgrade to sanitize-html >= 2.12.1 npm install sanitize-html@2.12.1 Patching the vulnerability We will exec into the container and check if the vulnerability exists: kali@kali:~/vicarious/cve-2024-21501$ docker run -it --rm --name test --entrypoint bash cve_2024_21501 root@55e7fc62d0e9:~# root@55e7fc62d0e9:~# node index.js @slonser_ // valid file path on backend @slonser_ // invalid file path on backend root@55e7fc62d0e9:~# Indeed it does! Let's run the detection script (or the single command in this case) and again check for the vulnerability: root@55e7fc62d0e9:~# npm install sanitize-html@2.12.1 changed 1 package, and audited 16 packages in 596ms 9 packages are looking for funding run `npm fund` for details found 0 vulnerabilities root@55e7fc62d0e9:~# node index.js @slonser_ // valid file path on backend @slonser_ // invalid file path on backend root@55e7fc62d0e9:~# Notice that this time the output doesn't processes the sourceMappingURL and therefore, the vulnerability has been successfully patched! We can also confirm the version of installed sanitize-html package from the package.json file: root@55e7fc62d0e9:~# cat package.json { "dependencies": { "sanitize-html": "^2.12.1" } } root@55e7fc62d0e9:~# And lastly, we can confirm the code patch by checking the source code for index.js file inside the sanitize-html package: root@55e7fc62d0e9:~# grep -n postcssParse node_modules/sanitize-html/index.js 6:const { parse: postcssParse } = require('postcss'); 456: const abstractSyntaxTree = postcssParse(name + ' {' + value + '}', { map: false }); root@55e7fc62d0e9:~# As we can clearly notice in the above output, the { map: false } argument passed to the postcssParse() function avoid processing of the source map URLs in the PostCSS, thus fixing this vulnerability!