sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, pos

Description

sanitize-html uses allowedSchemesAppliedToAttributes (default: ['href', 'src', 'cite']) to gate the naughtyHref() function that blocks dangerous URI schemes like javascript: and vbscript:.

Recommendation

Update the sanitize-html package to the latest compatible version. Followings are version details:

• Affected version(s): >= 1.18.0, <= 2.17.4
• Patched version(s): 2.17.5

References

• GHSA-vccv-cmxp-4j9h
• CVE-2026-53606
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS - CVE-2026-62324
• Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` - CVE-2026-44990
• CryptPad has a Sanitizer Bypass in Diffmarked.js that Allows Arbitrary HTML Injection and Potential XSS - CVE-2026-26028
• jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution - CVE-2026-24737

You might also like:

How to Secure your NodeJs Express Javascript Application - part 2

SmartScanner 2.3: Smarter JavaScript Detection, Faster Scans, and Powerful CLI Enhancements

How to Secure your NodeJs Express Javascript Application - part 1

Tags:

npm

sanitize-html