Is sanitize-html 1.2 vulnerable?

npm · 4 releases from 1.2.0 to 1.2.3 · latest sanitize-html is 2.18.1 · checked 2 Nov 2026

Yes: 10 known advisories

Yes. sanitize-html 1.2.3, the last 1.2 release, is affected by 10 known security advisories (1 high, 9 medium), including CVE-2022-25887, CVE-2026-113661, CVE-2026-113654. 1 more affects earlier 1.2.x releases. Upgrade to 2.18.0 or later to fix all of them.

Upgrade with:npm install sanitize-html@2.18.0

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting sanitize-html 1.2.3

  • MediumCVE-2026-113661GHSA-cv27-6wvh-8x7j20 Oct 2026

    ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

    Affected
    <2.18.0
    Fixed in
    2.18.0
  • MediumCVE-2026-113654GHSA-x3q4-9hxx-gx8m20 Oct 2026

    ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render

    Affected
    <2.18.0
    Fixed in
    2.18.0
  • MediumCVE-2026-63670GHSA-jxwj-j7wr-gfrw3 Sept 2026

    ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close

    Affected
    <2.17.6
    Fixed in
    2.17.6
  • MediumCVE-2019-25225GHSA-qhxp-v273-g94h8 Sept 2025

    sanitize-html is vulnerable to XSS through incomprehensive sanitization

    Affected
    <2.0.0-beta
    Fixed in
    2.0.0-beta
  • MediumCVE-2024-21501GHSA-rm97-x556-q36h24 Feb 2024

    sanitize-html Information Exposure vulnerability

    Affected
    <2.12.1
    Fixed in
    2.12.1
  • HighCVE-2022-25887GHSA-cgfm-xwp7-2cvr31 Aug 2022

    Sanitize-html Vulnerable To REDoS Attacks

    Affected
    <2.7.1
    Fixed in
    2.7.1
  • MediumCVE-2021-26540GHSA-mjxr-4v3x-q3m46 May 2021

    Improper Input Validation in sanitize-html

    Affected
    <2.3.2
    Fixed in
    2.3.2
  • MediumCVE-2021-26539GHSA-rjqq-98f6-6j3r6 May 2021

    Improper Input Validation in sanitize-html

    Affected
    <2.3.1
    Fixed in
    2.3.1
  • MediumCVE-2016-1000237GHSA-3j7m-hmh3-9jmp16 Apr 2020

    Cross-Site Scripting in sanitize-html

    Affected
    <1.4.3
    Fixed in
    1.4.3
  • MediumCVE-2017-16016GHSA-xc6g-ggrc-qq4r9 Nov 2018

    Cross-Site Scripting in sanitize-html

    Affected
    <1.11.4
    Fixed in
    1.11.4

Fixed within 1.2.x, affecting earlier releases

  • MediumCVE-2017-16017GHSA-wg96-3933-j2w59 Nov 2018

    Cross-Site Scripting in sanitize-html

    Affected
    <1.2.3
    Fixed in
    1.2.3

Which of your client projects are still on sanitize-html 1.2?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact sanitize-html version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other sanitize-html versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.