sanitize-html Information Exposure vulnerability

Description

Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies).

Recommendation

Update the sanitize-html package to the latest compatible version. Followings are version details:

Affected version(s): < 2.12.1
Patched version(s): 2.12.1

References

GHSA-rm97-x556-q36h
security.snyk.io
lists.fedoraproject.org
CVE-2024-21501
CWE-200
CWE-538
CAPEC-310
OWASP 2021-A1
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for sanitize-html Information Exposure vulnerability and gives you actionable findings to investigate.

Start a free scan

Related Issues

Cross-Site Scripting in sanitize-html - sanitize-html - GHSA-3j7m-hmh3-9jmp - CVE-2016-1000237
sanitize-html is vulnerable to XSS through incomprehensive sanitization - CVE-2019-25225
sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements - CVE-2026-40186
Improper Input Validation in sanitize-html - CVE-2021-26539

Exploiting Server Version Disclosure

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

See something that needs correcting? Let us knowUpdated March 22, 2026