Is sanitize-html 2.17 vulnerable?
npm · 8 releases from 2.17.0 to 2.17.7 · latest sanitize-html is 2.18.1 · checked 1 Nov 2026
Yes: 3 known advisories
Yes. sanitize-html 2.17.7, the last 2.17 release, is affected by 3 known security advisories (2 medium, 1 low), including CVE-2026-113661, CVE-2026-113654, CVE-2026-113657. 5 more affect earlier 2.17.x releases. Upgrade to 2.18.0 or later to fix all of them.
npm install sanitize-html@2.18.0Advisories affecting sanitize-html 2.17.7
ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)
- Affected
- >=2.17.7 <2.18.0
- Fixed in
- 2.18.0
ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs
- Affected
- <2.18.0
- Fixed in
- 2.18.0
ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render
- Affected
- <2.18.0
- Fixed in
- 2.18.0
Fixed within 2.17.x, affecting earlier releases
ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close
- Affected
- <2.17.6
- Fixed in
- 2.17.6
ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass
- Affected
- >=1.9.0 <2.17.7
- Fixed in
- 2.17.7
sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes
- Affected
- >=1.18.0 <2.17.5
- Fixed in
- 2.17.5
Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`
- Affected
- >=2.17.3 <2.17.4
- Fixed in
- 2.17.4
sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements
- Affected
- >=2.17.2 <2.17.3
- Fixed in
- 2.17.3
Which of your client projects are still on sanitize-html 2.17?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact sanitize-html version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other sanitize-html versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.