sanitize-html vulnerabilities

Clean up user-submitted HTML, preserving allowlisted elements and allowlisted attributes on a per-element basis

Registry
npm
Latest
2.18.1
License
MIT
Source
github.com/apostrophecms/apostrophe (opens the source repository in a new tab)

17 known advisories

The latest version, 2.18.1, is not affected by any of them. Projects on older versions may be.

Update to the latest version:npm install sanitize-html@2.18.1

Security advisories for sanitize-html

  • MediumGHSA-c9rx-x947-fp3h21 Oct 2026

    ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)

    Affected
    >=2.18.0 <2.18.1
    Fixed in
    2.18.1
  • LowGHSA-374f-7chj-994820 Oct 2026

    ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)

    Affected
    >=2.17.7 <2.18.0
    Fixed in
    2.18.0
  • MediumGHSA-cv27-6wvh-8x7j20 Oct 2026

    ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

    Affected
    <2.18.0
    Fixed in
    2.18.0
  • MediumGHSA-x3q4-9hxx-gx8m20 Oct 2026

    ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render

    Affected
    <2.18.0
    Fixed in
    2.18.0
  • MediumGHSA-jxwj-j7wr-gfrw3 Sept 2026

    ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close

    Affected
    <2.17.6
    Fixed in
    2.17.6
  • MediumGHSA-g8qq-57p8-ggw51 Sept 2026

    ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass

    Affected
    >=1.9.0 <2.17.7
    Fixed in
    2.17.7
  • MediumGHSA-vccv-cmxp-4j9h31 Jul 2026

    sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes

    Affected
    >=1.18.0 <2.17.5
    Fixed in
    2.17.5
  • CriticalGHSA-rpr9-rxv7-x64314 May 2026

    Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

    Affected
    >=2.17.3 <2.17.4
    Fixed in
    2.17.4
  • MediumGHSA-9mrh-v2v3-xpfm16 Apr 2026

    sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements

    Affected
    >=2.17.2 <2.17.3
    Fixed in
    2.17.3
  • MediumGHSA-qhxp-v273-g94h8 Sept 2025

    sanitize-html is vulnerable to XSS through incomprehensive sanitization

    Affected
    <2.0.0-beta
    Fixed in
    2.0.0-beta
  • MediumGHSA-rm97-x556-q36h24 Feb 2024

    sanitize-html Information Exposure vulnerability

    Affected
    <2.12.1
    Fixed in
    2.12.1
  • HighGHSA-cgfm-xwp7-2cvr31 Aug 2022

    Sanitize-html Vulnerable To REDoS Attacks

    Affected
    <2.7.1
    Fixed in
    2.7.1
  • MediumGHSA-mjxr-4v3x-q3m46 May 2021

    Improper Input Validation in sanitize-html

    Affected
    <2.3.2
    Fixed in
    2.3.2
  • MediumGHSA-rjqq-98f6-6j3r6 May 2021

    Improper Input Validation in sanitize-html

    Affected
    <2.3.1
    Fixed in
    2.3.1
  • MediumGHSA-3j7m-hmh3-9jmp16 Apr 2020

    Cross-Site Scripting in sanitize-html

    Affected
    <1.4.3
    Fixed in
    1.4.3
  • MediumGHSA-xc6g-ggrc-qq4r9 Nov 2018

    Cross-Site Scripting in sanitize-html

    Affected
    <1.11.4
    Fixed in
    1.11.4
  • MediumGHSA-wg96-3933-j2w59 Nov 2018

    Cross-Site Scripting in sanitize-html

    Affected
    <1.2.3
    Fixed in
    1.2.3

Which of your client projects still run an old sanitize-html?

NPMscan reads the package-lock.json, yarn.lock and pnpm-lock.yaml in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other npm packages

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the npm registry.