sanitize-html is vulnerable to XSS through incomprehensive sanitization

Description

sanitize-html prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The sanitizeHtml() function in index.js does not sanitize content when using the custom transformTags option, which is intended to convert attribute values into text. As a result, malicious input can be transformed into executable code.

Recommendation

Update the sanitize-html package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.0.0-beta
• Patched version(s): 2.0.0-beta

References

• GHSA-qhxp-v273-g94h
• CVE-2019-25225
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Sanitize-html Vulnerable To REDoS Attacks - CVE-2022-25887
• Webrecorder packages are vulnerable to XSS through 404 error handling logic - CVE-2025-58765
• @pdfme/common vulnerable to to XSS and Prototype Pollution through its expression evaluation - CVE-2025-53626
• Improper Input Validation in sanitize-html - CVE-2021-26539

Tags:

npm

sanitize-html