Description
sanitize-html prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The sanitizeHtml() function in index.js does not sanitize content when using the custom transformTags option, which is intended to convert attribute values into text. As a result, malicious input can be transformed into executable code.
Recommendation
Update the sanitize-html package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.0.0-beta
- Patched version(s): 2.0.0-beta
References
Could your website be exposed too?
SmartScanner can check your website for sanitize-html is vulnerable to XSS through incomprehensive sanitization and gives you actionable findings to investigate.
Start a free scanRelated Issues
- sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, pos - CVE-2026-53606
- Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` - CVE-2026-44990
- Sanitize-html Vulnerable To REDoS Attacks - CVE-2022-25887
- sanitize-html Information Exposure vulnerability - CVE-2024-21501
You might also like:
See something that needs correcting? Let us knowUpdated September 12, 2025