CVE-2021-33391

Name of the Vulnerable Software and Affected Versions HTACG HTML Tidy version 5.7.28

Description The issue allows an attacker to execute arbitrary code via the -g option of the CleanNode() function in gdoc.c. This is related to a use-after-free vulnerability in the CleanNode() function of the gdoc.c component. Exploitation of this issue may allow a remote attacker to cause a denial of service.

Recommendations For HTACG HTML Tidy version 5.7.28, consider disabling the CleanNode() function as a temporary workaround until a patch is available. Restrict access to the gdoc.c component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.