sanitize-html (npm)

Advisories

Latest version

—

License

—

OpenSSF Scorecard

—

How to fix

Upgrading to 2.18.1 or later clears every advisory below that has a fix.

Upgrade commands

npm

npm install sanitize-html@2.18.1

yarn

yarn add sanitize-html@2.18.1

pnpm

pnpm add sanitize-html@2.18.1

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
GHSA-cv27-6wvh-8x7j ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs	Medium EPSS 0.26%	`< 2.18.0`	`2.18.0`
GHSA-374f-7chj-9948 ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)	Low EPSS 0.31%	`>= 2.17.7, < 2.18.0`	`2.18.0`
GHSA-x3q4-9hxx-gx8m ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render	Medium EPSS 0.43%	`< 2.18.0`	`2.18.0`
GHSA-c9rx-x947-fp3h ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)	Medium EPSS 0.48%	`>= 2.18.0, < 2.18.1`	`2.18.1`
GHSA-g8qq-57p8-ggw5 ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass	Medium EPSS 0.30%	`>= 1.9.0, < 2.17.7`	`2.17.7`
GHSA-jxwj-j7wr-gfrw ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close	Medium EPSS 0.33%	`< 2.17.6`	`2.17.6`
GHSA-vccv-cmxp-4j9h sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes	Medium EPSS 0.21%	`>= 1.18.0, < 2.17.5`	`2.17.5`
GHSA-rpr9-rxv7-x643 Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`	Critical EPSS 0.68%	`>= 2.17.3, < 2.17.4`	`2.17.4`
GHSA-9mrh-v2v3-xpfm sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements	Medium EPSS 0.25%	`>= 2.17.2, < 2.17.3`	`2.17.3`
GHSA-qhxp-v273-g94h sanitize-html is vulnerable to XSS through incomprehensive sanitization	Medium EPSS 0.27%	`< 2.0.0-beta`	`2.0.0-beta`
GHSA-rm97-x556-q36h sanitize-html Information Exposure vulnerability	Medium EPSS 1.03%	`< 2.12.1`	`2.12.1`
GHSA-cgfm-xwp7-2cvr Sanitize-html Vulnerable To REDoS Attacks	High EPSS 1.55%	`< 2.7.1`	`2.7.1`
GHSA-mjxr-4v3x-q3m4 Improper Input Validation in sanitize-html	Medium EPSS 1.75%	`< 2.3.2`	`2.3.2`
GHSA-rjqq-98f6-6j3r Improper Input Validation in sanitize-html	Medium EPSS 1.95%	`< 2.3.1`	`2.3.1`
GHSA-3j7m-hmh3-9jmp Cross-Site Scripting in sanitize-html	Medium EPSS 0.84%	`< 1.4.3`	`1.4.3`
GHSA-xc6g-ggrc-qq4r Cross-Site Scripting in sanitize-html	Medium EPSS 1.34%	`< 1.11.4`	`1.11.4`
GHSA-wg96-3933-j2w5 Cross-Site Scripting in sanitize-html	Medium EPSS 1.17%	`< 1.2.3`	`1.2.3`

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor