Skip to main content
cve.nowby Sazabi
← npm
npmPackage

sanitize-html

18 known vulnerabilities (1 critical, 11 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
2.18.1 (Oct 14, 2026): no advisory affects it
Newest unaffected release
2.18.1 (Oct 14, 2026), the latest release
Advisories
18 · 1 critical, 11 medium, 1 low
Weekly downloads
17.9M
Dependents
3,281
Releases
128 since 0.1.0 (Sep 10, 2013)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Show all 18 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 18

  • CVE-2026-113661Medium 5.4

    ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

    Affected: fixed in 2.18.0.

    Fixed in 2.18.0 (released Sep 30, 2026, 20 days before disclosure).

    The latest release, 2.18.1, is not affected.

    57% of sanitize-html downloads last week were affected versions (11.1M).

  • ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)

    Affected: from 2.17.7, fixed in 2.18.0.

    Fixed in 2.18.0 (released Sep 30, 2026, 20 days before disclosure).

    The latest release, 2.18.1, is not affected.

    12% of sanitize-html downloads last week were affected versions (2.4M).

  • CVE-2026-113654Medium 5.3

    ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render

    Affected: fixed in 2.18.0.

    Fixed in 2.18.0 (released Sep 30, 2026, 20 days before disclosure).

    The latest release, 2.18.1, is not affected.

    57% of sanitize-html downloads last week were affected versions (11.1M).

  • CVE-2026-113650Medium 5.3

    ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)

    Affected: from 2.18.0, fixed in 2.18.1.

    Fixed in 2.18.1 (released Oct 14, 2026, 6 days before disclosure).

    The latest release, 2.18.1, is not affected.

    4.6% of sanitize-html downloads last week were affected versions (886.5K).

  • CVE-2026-84371Medium 5.4

    ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass

    Affected: from 1.9.0, fixed in 2.17.7.

    Fixed in 2.17.7 (released Aug 13, 2026, 19 days before disclosure).

    The latest release, 2.18.1, is not affected.

    45% of sanitize-html downloads last week were affected versions (8.7M).

  • CVE-2026-63670Medium 6.1

    ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close

    Affected: fixed in 2.17.6.

    Fixed in 2.17.6 (released Jul 10, 2026, 38 days before disclosure).

    The latest release, 2.18.1, is not affected.

    41% of sanitize-html downloads last week were affected versions (7.9M).

  • CVE-2026-53606Medium 5.4

    sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and…

    Affected: from 1.18.0, fixed in 2.17.5.

    Fixed in 2.17.5 (released Jun 10, 2026, 2 days before disclosure).

    The latest release, 2.18.1, is not affected.

    34% of sanitize-html downloads last week were affected versions (6.5M).

  • CVE-2026-44990Critical 9.3

    Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

    Affected: from 2.17.3, fixed in 2.17.4.

    Fixed in 2.17.4 (released May 13, 2026, 30 days before disclosure).

    The latest release, 2.18.1, is not affected.

    1.5% of sanitize-html downloads last week were affected versions (301.1K).

  • CVE-2026-40186Medium 6.1

    ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements

    Affected: from 2.17.2, fixed in 2.17.3.

    Fixed in 2.17.3 (released Apr 15, 2026, the day of disclosure).

    The latest release, 2.18.1, is not affected.

    1.2% of sanitize-html downloads last week were affected versions (242.4K).

  • CVE-2014-125128Medium 6.1

    'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS).

    Affected: fixed in 1.0.3.

    Fixed in 1.0.3 (released Jan 17, 2014, 4252 days before disclosure).

    The latest release, 2.18.1, is not affected.

    <0.1% of sanitize-html downloads last week were affected versions (358).

  • CVE-2019-25225Medium 6.1

    `sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS).

    Affected: fixed in 2.0.0-beta; fixed in 2.0.0-beta.

    Fixed in 2.0.0-beta (released Jul 29, 2020, 1867 days before disclosure).

    The latest release, 2.18.1, is not affected.

    2.3% of sanitize-html downloads last week were affected versions (447K).

  • CVE-2024-21501Medium 5.3

    Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style…

    Affected: fixed in 2.12.1.

    Fixed in 2.12.1 (released Feb 22, 2024, 2 days before disclosure).

    The latest release, 2.18.1, is not affected.

    8.6% of sanitize-html downloads last week were affected versions (1.7M).

  • CVE-2022-25887Medium 5.3

    Regular Expression Denial of Service (ReDoS)

    Affected: fixed in 2.7.1.

    Fixed in 2.7.1 (released Jul 20, 2022, 41 days before disclosure).

    The latest release, 2.18.1, is not affected.

    6.6% of sanitize-html downloads last week were affected versions (1.3M).

  • Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option…

    Affected: fixed in 2.3.2.

    Fixed in 2.3.2 (released Jan 26, 2021, 13 days before disclosure).

    The latest release, 2.18.1, is not affected.

    2.3% of sanitize-html downloads last week were affected versions (452.4K).

  • Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an…

    Affected: fixed in 2.3.1.

    Fixed in 2.3.1 (released Jan 22, 2021, 17 days before disclosure).

    The latest release, 2.18.1, is not affected.

    2.3% of sanitize-html downloads last week were affected versions (452.3K).

Show all 18 advisoriesShow fewer advisories

  • sanitize-html before 1.4.3 has XSS.

    Affected: fixed in 1.4.3.

    Fixed in 1.4.3 (released Oct 14, 2014, 1927 days before disclosure).

    The latest release, 2.18.1, is not affected.

    0.3% of sanitize-html downloads last week were affected versions (50.2K).

  • sanitize-html is a library for scrubbing html input for malicious values Versions 1.2.2 and below have a cross site scripting vulnerability.

    Affected: fixed in 1.2.3.

    Fixed in 1.2.3 (released Jul 18, 2014, 1417 days before disclosure).

    The latest release, 2.18.1, is not affected.

    <0.1% of sanitize-html downloads last week were affected versions (855).

  • Sanitize-html is a library for scrubbing html input of malicious values.

    Affected: fixed in 1.11.4.

    Fixed in 1.11.4 (released Mar 28, 2016, 798 days before disclosure).

    The latest release, 2.18.1, is not affected.

    0.3% of sanitize-html downloads last week were affected versions (52.7K).