CVE-2021-33391

What it actually does

Use-after-free in CleanNode() of gdoc.c allows arbitrary code execution when the -g option processes attacker-controlled input in HTACG HTML Tidy.

Why it matters to the business

Remote attackers can fully compromise any system running the affected tidy binary, enabling data theft or malware deployment; the flaw has been public for over three years with no listed fixes and available exploits.

How an attack unfolds

An attacker supplies a crafted input file and runs the tidy binary using the -g flag, triggering the use-after-free in CleanNode() to achieve code execution on the target host.

How to fix it

Upgrade HTACG HTML Tidy to a version containing the fix for this use-after-free; if no patched release is available, disable or restrict the -g option for untrusted content and consider alternative HTML processors.

How to confirm the fix worked

Reproduce the issue with known trigger inputs under the -g option, then confirm absence of crashes or memory errors after applying updates; scan for remaining vulnerable binaries via package inventory.

Typical attack path

1. Identify systems exposing or using the tidy binary on untrusted input
2. Craft malicious input that triggers the use-after-free path in gdoc.c
3. Invoke tidy with the -g option against the input
4. Leverage the resulting memory corruption for arbitrary code execution

How to detect it

Review command-line audit logs and process execution records for tidy invocations containing the -g flag; correlate with subsequent suspicious child processes or memory-related crashes in tidy.

What your security team should do

• Inventory all deployments of HTACG tidy and remove or isolate instances using the -g option
• Apply updates or workarounds immediately given the public exploit availability and multi-year exposure window
• Block or log invocations of tidy -g on untrusted data sources
• Replace tidy usage with maintained HTML sanitization libraries where possible