Description
Commit 49d0bb7 introduced a regression in sanitize-html that bypasses allowedTags enforcement for text inside nonTextTagsArray elements (textarea and option). Entity-encoded HTML inside these elements passes through the sanitizer as decoded, unescaped HTML, allowing injection of arbitrary tags including XSS payloads.
Recommendation
Update the sanitize-html package to the latest compatible version. Followings are version details:
- Affected version(s): >= 2.17.2, < 2.17.3
- Patched version(s): 2.17.3
References
Could your website be exposed too?
SmartScanner can check your website for sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` - CVE-2026-44990
- Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe() - CVE-2026-39315
- LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS - CVE-2026-44644
- sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, pos - CVE-2026-53606
You might also like:
See something that needs correcting? Let us knowUpdated April 16, 2026