Improper Input Validation in sanitize-html

Description

Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the “allowedIframeHostnames” option.

Recommendation

Update the sanitize-html package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.3.1
• Patched version(s): 2.3.1

References

• GHSA-rjqq-98f6-6j3r
• advisory.checkmarx.net
• CVE-2021-26539
• CWE-20
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• parse is vulnerable to prototype pollution - CVE-2025-57324
• static-server Path Traversal vulnerability - CVE-2023-26152
• sanitize-html is vulnerable to XSS through incomprehensive sanitization - CVE-2019-25225
• chromedriver Downloads Resources over HTTP - CVE-2016-10579

Tags:

npm

sanitize-html