Cross-Site Scripting in sanitize-html (GHSA-xc6g-ggrc-qq4r)

Description

Affected versions of sanitize-html are vulnerable to cross-site scripting when allowedTags includes at least one nonTextTag.

Recommendation

Update the sanitize-html package to the latest compatible version. Followings are version details:

• Affected version(s): <= 1.11.1
• Patched version(s): 1.11.4

References

• GHSA-xc6g-ggrc-qq4r
• npmjs.com
• www.npmjs.com
• CVE-2017-16016
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• jsPDF has Local File Inclusion/Path Traversal vulnerability - CVE-2025-68428
• Prebid-universal-creative latest on npm briefly compromised - CVE-2025-59039
• JS Html Sanitizer allows XSS when used with contentEditable - CVE-2025-29771
• Potential XSS vulnerability in jQuery (GHSA-gxr4-xjj5-5px2) - CVE-2020-11022

Tags:

npm

sanitize-html