Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

Description

Under the default configuration, sanitize-html can turn attacker-controlled content inside a disallowed xmp element into live HTML or JavaScript. This is a sanitizer bypass in the default disallowedTagsMode: 'discard' path and can lead to stored XSS in applications that render sanitized output back to users.

Recommendation

Update the sanitize-html package to the latest compatible version. Followings are version details:

• Affected version(s): = 2.17.3
• Patched version(s): 2.17.4

References

• GHSA-rpr9-rxv7-x643
• CVE-2026-44990
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements - CVE-2026-40186
• TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes - CVE-2026-55661
• SCEditor has DOM XSS via emoticon URL/HTML injection - CVE-2026-25581
• sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, pos - CVE-2026-53606

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

sanitize-html