# sanitize-html (npm) vulnerabilities

18 known vulnerabilities (1 critical, 11 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 2.18.1 (Oct 14, 2026): no advisory affects it
- Newest unaffected release: 2.18.1 (Oct 14, 2026), the latest release
- Weekly downloads: 17.9M
- Dependents: 3,281
- Releases: 128 since 0.1.0 (Sep 10, 2013)
- Registry: https://www.npmjs.com/package/sanitize-html
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-113661: 0.1.0 to 2.17.7 (2.18.0 is outside it)
- CVE-2026-113657: 2.17.7 (2.18.0 is outside it)
- CVE-2026-113654: 0.1.0 to 2.17.7 (2.18.0 is outside it)
- CVE-2026-113650: 2.18.0 (2.18.1 is outside it)
- CVE-2026-84371: 1.9.0 to 2.17.6 (2.17.7 is outside it)
- CVE-2026-63670: 0.1.0 to 2.17.5 (2.17.6 is outside it)
- CVE-2026-53606: 1.18.0 to 2.17.5-alpha.1 (2.17.5 is outside it)
- CVE-2026-44990: 2.17.3 (2.17.4 is outside it)
- CVE-2026-40186: 2.17.2 (2.17.3 is outside it)
- CVE-2014-125128: 0.1.0 to 1.0.2 (1.0.3 is outside it)
- CVE-2019-25225: 0.1.0 to 1.27.5 (2.0.0-beta is outside it)
- CVE-2024-21501: 0.1.0 to 2.12.0 (2.12.1 is outside it)
- CVE-2022-25887: 0.1.0 to 2.7.0 (2.7.1 is outside it)
- CVE-2021-26540: 0.1.0 to 2.3.1 (2.3.2 is outside it)
- CVE-2021-26539: 0.1.0 to 2.3.0 (2.3.1 is outside it)
- CVE-2016-1000237: 0.1.0 to 1.4.2 (1.4.3 is outside it)
- CVE-2017-16017: 0.1.0 to 1.2.2 (1.2.3 is outside it)
- CVE-2017-16016: 0.1.0 to 1.11.3 (1.11.4 is outside it)

## Advisories (18)

### [CVE-2026-113661](https://cve.now/CVE-2026-113661): ApostropheCMS: Incomplete CVE-2026-53606: \`meta http-equiv=refresh\` \`content\` still ships \`javascript:\` / \`data:\` URLs

- Severity: Medium 5.4
- Published: Oct 20, 2026
- Affected: fixed in 2.18.0.
- Fixed in 2.18.0 (released Sep 30, 2026, 20 days before disclosure).
- The latest release, 2.18.1, is not affected.
- 57% of sanitize-html downloads last week were affected versions (11.1M).

### [CVE-2026-113657](https://cve.now/CVE-2026-113657): ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)

- Severity: Low 3.7
- Published: Oct 20, 2026
- Affected: from 2.17.7, fixed in 2.18.0.
- Fixed in 2.18.0 (released Sep 30, 2026, 20 days before disclosure).
- The latest release, 2.18.1, is not affected.
- 12% of sanitize-html downloads last week were affected versions (2.4M).

### [CVE-2026-113654](https://cve.now/CVE-2026-113654): ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting \<noscript\> content render

- Severity: Medium 5.3
- Published: Oct 20, 2026
- Affected: fixed in 2.18.0.
- Fixed in 2.18.0 (released Sep 30, 2026, 20 days before disclosure).
- The latest release, 2.18.1, is not affected.
- 57% of sanitize-html downloads last week were affected versions (11.1M).

### [CVE-2026-113650](https://cve.now/CVE-2026-113650): ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)

- Severity: Medium 5.3
- Published: Oct 20, 2026
- Affected: from 2.18.0, fixed in 2.18.1.
- Fixed in 2.18.1 (released Oct 14, 2026, 6 days before disclosure).
- The latest release, 2.18.1, is not affected.
- 4.6% of sanitize-html downloads last week were affected versions (886.5K).

### [CVE-2026-84371](https://cve.now/CVE-2026-84371): ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass

- Severity: Medium 5.4
- Published: Sep 1, 2026
- Affected: from 1.9.0, fixed in 2.17.7.
- Fixed in 2.17.7 (released Aug 13, 2026, 19 days before disclosure).
- The latest release, 2.18.1, is not affected.
- 45% of sanitize-html downloads last week were affected versions (8.7M).

### [CVE-2026-63670](https://cve.now/CVE-2026-63670): ApostropheCMS: Mutation-XSS / allowedTags bypass via literal \`\</textarea/\>\` solidus close

- Severity: Medium 6.1
- Published: Aug 17, 2026
- Affected: fixed in 2.17.6.
- Fixed in 2.17.6 (released Jul 10, 2026, 38 days before disclosure).
- The latest release, 2.18.1, is not affected.
- 41% of sanitize-html downloads last week were affected versions (7.9M).

### [CVE-2026-53606](https://cve.now/CVE-2026-53606): sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and…

- Severity: Medium 5.4
- Published: Jun 12, 2026
- Affected: from 1.18.0, fixed in 2.17.5.
- Fixed in 2.17.5 (released Jun 10, 2026, 2 days before disclosure).
- The latest release, 2.18.1, is not affected.
- 34% of sanitize-html downloads last week were affected versions (6.5M).

### [CVE-2026-44990](https://cve.now/CVE-2026-44990): Apostrophe has default XSS via \`xmp\` raw-text passthrough in \`sanitize-html\`

- Severity: Critical 9.3
- Published: Jun 12, 2026
- Affected: from 2.17.3, fixed in 2.17.4.
- Fixed in 2.17.4 (released May 13, 2026, 30 days before disclosure).
- The latest release, 2.18.1, is not affected.
- 1.5% of sanitize-html downloads last week were affected versions (301.1K).

### [CVE-2026-40186](https://cve.now/CVE-2026-40186): ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements

- Severity: Medium 6.1
- Published: Apr 15, 2026
- Affected: from 2.17.2, fixed in 2.17.3.
- Fixed in 2.17.3 (released Apr 15, 2026, the day of disclosure).
- The latest release, 2.18.1, is not affected.
- 1.2% of sanitize-html downloads last week were affected versions (242.4K).

### [CVE-2014-125128](https://cve.now/CVE-2014-125128): 'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS).

- Severity: Medium 6.1
- Published: Sep 8, 2025
- Affected: fixed in 1.0.3.
- Fixed in 1.0.3 (released Jan 17, 2014, 4252 days before disclosure).
- The latest release, 2.18.1, is not affected.
- <0.1% of sanitize-html downloads last week were affected versions (358).

### [CVE-2019-25225](https://cve.now/CVE-2019-25225): \`sanitize-html\` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS).

- Severity: Medium 6.1
- Published: Sep 8, 2025
- Affected: fixed in 2.0.0-beta; fixed in 2.0.0-beta.
- Fixed in 2.0.0-beta (released Jul 29, 2020, 1867 days before disclosure).
- The latest release, 2.18.1, is not affected.
- 2.3% of sanitize-html downloads last week were affected versions (447K).

### [CVE-2024-21501](https://cve.now/CVE-2024-21501): Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style…

- Severity: Medium 5.3
- Published: Feb 24, 2024
- Affected: fixed in 2.12.1.
- Fixed in 2.12.1 (released Feb 22, 2024, 2 days before disclosure).
- The latest release, 2.18.1, is not affected.
- 8.6% of sanitize-html downloads last week were affected versions (1.7M).

### [CVE-2022-25887](https://cve.now/CVE-2022-25887): Regular Expression Denial of Service (ReDoS)

- Severity: Medium 5.3
- Published: Aug 30, 2022
- Affected: fixed in 2.7.1.
- Fixed in 2.7.1 (released Jul 20, 2022, 41 days before disclosure).
- The latest release, 2.18.1, is not affected.
- 6.6% of sanitize-html downloads last week were affected versions (1.3M).

### [CVE-2021-26540](https://cve.now/CVE-2021-26540): Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option…

- Severity: Unrated
- Published: Feb 8, 2021
- Affected: fixed in 2.3.2.
- Fixed in 2.3.2 (released Jan 26, 2021, 13 days before disclosure).
- The latest release, 2.18.1, is not affected.
- 2.3% of sanitize-html downloads last week were affected versions (452.4K).

### [CVE-2021-26539](https://cve.now/CVE-2021-26539): Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an…

- Severity: Unrated
- Published: Feb 8, 2021
- Affected: fixed in 2.3.1.
- Fixed in 2.3.1 (released Jan 22, 2021, 17 days before disclosure).
- The latest release, 2.18.1, is not affected.
- 2.3% of sanitize-html downloads last week were affected versions (452.3K).

### [CVE-2016-1000237](https://cve.now/CVE-2016-1000237): sanitize-html before 1.4.3 has XSS.

- Severity: Unrated
- Published: Jan 23, 2020
- Affected: fixed in 1.4.3.
- Fixed in 1.4.3 (released Oct 14, 2014, 1927 days before disclosure).
- The latest release, 2.18.1, is not affected.
- 0.3% of sanitize-html downloads last week were affected versions (50.2K).

### [CVE-2017-16017](https://cve.now/CVE-2017-16017): sanitize-html is a library for scrubbing html input for malicious values Versions 1.2.2 and below have a cross site scripting vulnerability.

- Severity: Unrated
- Published: Jun 4, 2018
- Affected: fixed in 1.2.3.
- Fixed in 1.2.3 (released Jul 18, 2014, 1417 days before disclosure).
- The latest release, 2.18.1, is not affected.
- <0.1% of sanitize-html downloads last week were affected versions (855).

### [CVE-2017-16016](https://cve.now/CVE-2017-16016): Sanitize-html is a library for scrubbing html input of malicious values.

- Severity: Unrated
- Published: Jun 4, 2018
- Affected: fixed in 1.11.4.
- Fixed in 1.11.4 (released Mar 28, 2016, 798 days before disclosure).
- The latest release, 2.18.1, is not affected.
- 0.3% of sanitize-html downloads last week were affected versions (52.7K).

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/npm/sanitize-html
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.