Is sanitize-html 2.15 vulnerable?

npm · 1 release from 2.15.0 to 2.15.0 · latest sanitize-html is 2.18.1 · checked 1 Nov 2026

Yes: 5 known advisories

Yes. sanitize-html 2.15.0, the last 2.15 release, is affected by 5 known security advisories (5 medium), including CVE-2026-113661, CVE-2026-113654, CVE-2026-63670. Upgrade to 2.18.0 or later to fix all of them.

Upgrade with:npm install sanitize-html@2.18.0

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting sanitize-html 2.15.0

  • MediumCVE-2026-113661GHSA-cv27-6wvh-8x7j20 Oct 2026

    ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

    Affected
    <2.18.0
    Fixed in
    2.18.0
  • MediumCVE-2026-113654GHSA-x3q4-9hxx-gx8m20 Oct 2026

    ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render

    Affected
    <2.18.0
    Fixed in
    2.18.0
  • MediumCVE-2026-63670GHSA-jxwj-j7wr-gfrw3 Sept 2026

    ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close

    Affected
    <2.17.6
    Fixed in
    2.17.6
  • MediumCVE-2026-84371GHSA-g8qq-57p8-ggw51 Sept 2026

    ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass

    Affected
    >=1.9.0 <2.17.7
    Fixed in
    2.17.7
  • MediumCVE-2026-53606GHSA-vccv-cmxp-4j9h31 Jul 2026

    sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes

    Affected
    >=1.18.0 <2.17.5
    Fixed in
    2.17.5

Which of your client projects are still on sanitize-html 2.15?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact sanitize-html version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other sanitize-html versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.