Description
sanitize-html uses allowedSchemesAppliedToAttributes (default: ['href', 'src', 'cite']) to gate the naughtyHref() function that blocks dangerous URI schemes like javascript: and vbscript:.
Recommendation
Update the sanitize-html package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.18.0, <= 2.17.4
- Patched version(s): 2.17.5
References
Could your website be exposed too?
SmartScanner can check your website for sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, pos and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS - CVE-2026-62324
- Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` - CVE-2026-44990
- CryptPad has a Sanitizer Bypass in Diffmarked.js that Allows Arbitrary HTML Injection and Potential XSS - CVE-2026-26028
- jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution - CVE-2026-24737
You might also like:
See something that needs correcting? Let us knowUpdated July 31, 2026