SA
Product
sanitize-html
14
CVEs
0
On KEV
9.3
Max CVSS
4
New 30D
Severity mix
Critical 1High 1Medium 11Low 1
Watch
Add sanitize-html to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-44990 | 9.3 | Jun 12 | Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` Affected: < 2.17.4 |
| CVE-2022-25887 | 7.5 | Aug 30 | The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment… Affected: before 2.7.1 |
| CVE-2026-40186 | 6.1 | Apr 15 | ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements Affected: >= 2.17.1, < 2.17.2 |
| CVE-2014-125128 | 6.1 | Sep 8 | 'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS) Affected: before 1.0.3 |
| CVE-2019-25225 | 6.1 | Sep 8 | `sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS) Affected: before 2.0.0 |
| CVE-2016-1000237 | 6.1 | Jan 23 | sanitize-html before 1.4.3 has XSS Affected: before 1.4.3 |
| CVE-2026-113661 | 5.4 | Oct 20 | ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs Affected: < 2.18.0 |
| CVE-2026-53606 | 5.4 | Jun 12 | sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and background attributes Affected: < 2.17.5 |
| CVE-2026-113654 | 5.3 | Oct 20 | ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render Affected: < 2.18.0 |
| CVE-2026-113650 | 5.3 | Oct 20 | ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced) Affected: >= 2.18.0, < 2.18.1 |
| CVE-2024-21501 | 5.3 | Feb 24 | Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of… Affected: before 2.12.1 |
| CVE-2021-26540 | 5.3 | Feb 8 | Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to… Affected: before 2.3.2 |
| CVE-2021-26539 | 5.3 | Feb 8 | Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist… Affected: before 2.3.1 |
| CVE-2026-113657 | 3.7 | Oct 20 | ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS) Affected: >= 2.17.7, < 2.18.0 |
Showing 14