Is sanitize-html 1.26 vulnerable?

npm · 1 release from 1.26.0 to 1.26.0 · latest sanitize-html is 2.18.1 · checked 1 Nov 2026

Yes: 10 known advisories

Yes. sanitize-html 1.26.0, the last 1.26 release, is affected by 10 known security advisories (1 high, 9 medium), including CVE-2022-25887, CVE-2026-113661, CVE-2026-113654. Upgrade to 2.18.0 or later to fix all of them.

Upgrade with:npm install sanitize-html@2.18.0

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting sanitize-html 1.26.0

  • MediumCVE-2026-113661GHSA-cv27-6wvh-8x7j20 Oct 2026

    ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

    Affected
    <2.18.0
    Fixed in
    2.18.0
  • MediumCVE-2026-113654GHSA-x3q4-9hxx-gx8m20 Oct 2026

    ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render

    Affected
    <2.18.0
    Fixed in
    2.18.0
  • MediumCVE-2026-63670GHSA-jxwj-j7wr-gfrw3 Sept 2026

    ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close

    Affected
    <2.17.6
    Fixed in
    2.17.6
  • MediumCVE-2026-84371GHSA-g8qq-57p8-ggw51 Sept 2026

    ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass

    Affected
    >=1.9.0 <2.17.7
    Fixed in
    2.17.7
  • MediumCVE-2026-53606GHSA-vccv-cmxp-4j9h31 Jul 2026

    sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes

    Affected
    >=1.18.0 <2.17.5
    Fixed in
    2.17.5
  • MediumCVE-2019-25225GHSA-qhxp-v273-g94h8 Sept 2025

    sanitize-html is vulnerable to XSS through incomprehensive sanitization

    Affected
    <2.0.0-beta
    Fixed in
    2.0.0-beta
  • MediumCVE-2024-21501GHSA-rm97-x556-q36h24 Feb 2024

    sanitize-html Information Exposure vulnerability

    Affected
    <2.12.1
    Fixed in
    2.12.1
  • HighCVE-2022-25887GHSA-cgfm-xwp7-2cvr31 Aug 2022

    Sanitize-html Vulnerable To REDoS Attacks

    Affected
    <2.7.1
    Fixed in
    2.7.1
  • MediumCVE-2021-26540GHSA-mjxr-4v3x-q3m46 May 2021

    Improper Input Validation in sanitize-html

    Affected
    <2.3.2
    Fixed in
    2.3.2
  • MediumCVE-2021-26539GHSA-rjqq-98f6-6j3r6 May 2021

    Improper Input Validation in sanitize-html

    Affected
    <2.3.1
    Fixed in
    2.3.1

Which of your client projects are still on sanitize-html 1.26?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact sanitize-html version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other sanitize-html versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.