MediumGHSA-qhxp-v273-g94hCVE-2019-25225
sanitize-html is vulnerable to XSS through incomprehensive sanitization
Published 8 Sept 2025 · Updated 12 Sept 2025
Affected package
- Affected
- <2.0.0-beta
- Fixed in
- 2.0.0-beta
Update to the fixed version for your release line, for example:
npm install sanitize-html@2.0.0-betaDetails
sanitize-html prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The sanitizeHtml() function in index.js does not sanitize content when using the custom transformTags option, which is intended to convert attribute values into text. As a result, malicious input can be transformed into executable code.
Is GHSA-qhxp-v273-g94h in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected sanitize-html, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2019-25225
- Linkgithub.com/apostrophecms/sanitize-html/issues/293
- Linkgithub.com/apostrophecms/sanitize-html/pull/156
- Linkgithub.com/apostrophecms/sanitize-html/commit/712cb6895825c8bb6ede71a16b42bade42abcaf3
- Linkgithub.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2019/CVE-2019-25225
- Packagegithub.com/apostrophecms/sanitize-html
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.