Is sanitize-html 2.6 vulnerable?

npm · 2 releases from 2.6.0 to 2.6.1 · latest sanitize-html is 2.18.1 · checked 2 Nov 2026

Yes: 7 known advisories

Yes. sanitize-html 2.6.1, the last 2.6 release, is affected by 7 known security advisories (1 high, 6 medium), including CVE-2022-25887, CVE-2026-113661, CVE-2026-113654. Upgrade to 2.18.0 or later to fix all of them.

Upgrade with:npm install sanitize-html@2.18.0

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting sanitize-html 2.6.1

  • MediumCVE-2026-113661GHSA-cv27-6wvh-8x7j20 Oct 2026

    ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

    Affected
    <2.18.0
    Fixed in
    2.18.0
  • MediumCVE-2026-113654GHSA-x3q4-9hxx-gx8m20 Oct 2026

    ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render

    Affected
    <2.18.0
    Fixed in
    2.18.0
  • MediumCVE-2026-63670GHSA-jxwj-j7wr-gfrw3 Sept 2026

    ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close

    Affected
    <2.17.6
    Fixed in
    2.17.6
  • MediumCVE-2026-84371GHSA-g8qq-57p8-ggw51 Sept 2026

    ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass

    Affected
    >=1.9.0 <2.17.7
    Fixed in
    2.17.7
  • MediumCVE-2026-53606GHSA-vccv-cmxp-4j9h31 Jul 2026

    sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes

    Affected
    >=1.18.0 <2.17.5
    Fixed in
    2.17.5
  • MediumCVE-2024-21501GHSA-rm97-x556-q36h24 Feb 2024

    sanitize-html Information Exposure vulnerability

    Affected
    <2.12.1
    Fixed in
    2.12.1
  • HighCVE-2022-25887GHSA-cgfm-xwp7-2cvr31 Aug 2022

    Sanitize-html Vulnerable To REDoS Attacks

    Affected
    <2.7.1
    Fixed in
    2.7.1

Which of your client projects are still on sanitize-html 2.6?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact sanitize-html version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other sanitize-html versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.