sanitize-html has 3 CVEs on record. 2 were published in the last 90 days. The median CVSS is 5.4 (medium). The most common weakness class is CWE-79 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.4
- Publish → KEV
- —
- Last 90 days
- 2 prev 1
Weakness classes
Products
- sanitize-html 3
Worst active — by depth score
CVE-2026-63670Medium· 6.1ApostropheCMS is an open-source Node.js content management system34CVE-2026-113657Low· 3.7ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)32CVE-2026-53606Medium· 5.4sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes30
sanitize-html vulnerabilities
CVEs affecting sanitize-html, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-113657Low· 3.7PoCApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)
ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)
CVE-2026-63670Medium· 6.1ApostropheCMS is an open-source Node.js content management system
ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a li…
CVE-2026-53606Medium· 5.4sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes
sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes