sanitize-html vulnerabilities

CVEs whose affected-version data names the sanitize-html package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

7 CVEsRSS

CVE-2026-113650Medium· 5.3

6d ago

ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)

▾ Sunlitsanitize-html · sanitize-htmlEPSS 0.40%via GHSA

CVE-2026-113661Medium· 5.4

1w ago

ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that allows meta refresh elements and thei…

▾ Sunlitapostrophecms · apostropheEPSS 0.26%via CVEORG

CVE-2026-113654Medium· 5.3

1w ago

ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render

▾ Sunlitsanitize-html · sanitize-htmlEPSS 0.35%via GHSA

CVE-2026-113657Low· 3.7PoC

1w ago

ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)

▾ Twilightsanitize-html · sanitize-htmlEPSS 0.31%via GHSA

CVE-2026-63670Medium· 6.1

2mo ago

ApostropheCMS is an open-source Node.js content management system

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a li…

▾ Sunlitsanitize-html · sanitize-htmlEPSS 0.33%via NVD

CVE-2026-53606Medium· 5.4

2mo ago

sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes

▾ Sunlitsanitize-html · sanitize-htmlEPSS 0.21%via GHSA

CVE-2026-44990Critical· 9.3PoC

4mo ago

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-contro…

▾ Abyssalapostrophecms · sanitize-htmlEPSS 0.68%via NVD