sanitize-html vulnerabilities

CVEs whose affected-version data names the sanitize-html package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

3 CVEsRSS

CVE-2026-63670Medium· 6.1

1mo ago

ApostropheCMS is an open-source Node.js content management system

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a li…

▾ Sunlitsanitize-html · sanitize-htmlEPSS 0.29%via NVD

CVE-2026-53606Medium· 5.4

1mo ago

sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes

▾ Sunlitsanitize-html · sanitize-htmlEPSS 0.18%via GHSA

CVE-2026-44990Critical· 9.3PoC

3mo ago

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-contro…

▾ Abyssalapostrophecms · sanitize-htmlEPSS 0.60%via NVD