Description
Under the default configuration, sanitize-html can turn attacker-controlled content inside a disallowed xmp element into live HTML or JavaScript. This is a sanitizer bypass in the default disallowedTagsMode: 'discard' path and can lead to stored XSS in applications that render sanitized output back to users.
Recommendation
Update the sanitize-html package to the latest compatible version. Followings are version details:
- Affected version(s): = 2.17.3
- Patched version(s): 2.17.4
References
Could your website be exposed too?
SmartScanner can check your website for Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` and gives you actionable findings to investigate.
Start a free scanRelated Issues
- sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements - CVE-2026-40186
- TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes - CVE-2026-55661
- SCEditor has DOM XSS via emoticon URL/HTML injection - CVE-2026-25581
- sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, pos - CVE-2026-53606
You might also like:
See something that needs correcting? Let us knowUpdated June 12, 2026