Login Request a demo
SA
Product
sanitize-html
by apostrophecms · last CVE Oct 20, 2026
14
CVEs
0
On KEV
9.3
Max CVSS
4
New 30D
Vulnerabilities14In the news0Timeline
Severity mix
Critical 1High 1Medium 11Low 1
Severity
All severities14Critical1High1Medium11Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add sanitize-html to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-40186
6.1
0%
Apr 15
ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements
Affected: >= 2.17.1, < 2.17.2
CVE-2014-125128
6.1
0%
Sep 8
'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS)
Affected: before 1.0.3
CVE-2019-25225
6.1
0%
Sep 8
`sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS)
Affected: before 2.0.0
CVE-2016-1000237
6.1
1%
Jan 23
sanitize-html before 1.4.3 has XSS
Affected: before 1.4.3
CVE-2026-113661
5.4
0%
Oct 20
ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs
Affected: < 2.18.0
CVE-2026-53606
5.4
0%
Jun 12
sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and background attributes
Affected: < 2.17.5
CVE-2026-113654
5.3
0%
Oct 20
ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render
Affected: < 2.18.0
CVE-2026-113650
5.3
0%
Oct 20
ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)
Affected: >= 2.18.0, < 2.18.1
CVE-2024-21501
5.3
1%
Feb 24
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of…
Affected: before 2.12.1
CVE-2021-26540
5.3
2%
Feb 8
Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to…
Affected: before 2.3.2
CVE-2021-26539
5.3
2%
Feb 8
Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist…
Affected: before 2.3.1
Showing 11