sanitize-html CVE-2026-84371

Exploitation requires three concurrent conditions: (1) sanitize-html must be configured with at least one SVG animation element (animate, animateColor, animateMotion, animateTransform, or set) in allowedTags - this is explicitly a non-default, opt-in setting; (2) the attacker must have access to submit or store HTML/SVG content that is processed by the misconfigured sanitizer (CVSS PR:L - an authenticated low-privilege user such as a CMS editor or contributor); (3) a victim must click or activate the sanitized SVG link in a browser (CVSS UI:R). The default sanitize-html configuration does not permit SVG animation elements and is not affected. Applications that accept anonymous SVG submissions with animation enabled face a higher practical risk profile than PR:L implies, as attacker authentication would not be required.

The vendor-assigned CVSS 3.1 score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). The AC:L metric likely overstates ease of exploitation: the vulnerability activates only when SVG animation elements are explicitly added to allowedTags, which is a non-default, opt-in configuration - the default sanitize-html installation is unaffected. An independent assessment of AC:H better reflects this deployment precondition. PR:L is accurate because the attacker must have content-submission access (a CMS editor, contributor, or similar authenticated role). UI:R reflects the victim-click requirement that prevents mass automated exploitation. No EPSS data was provided and no CISA KEV listing is present; however, a functional proof-of-concept against sanitize-html 2.17.6 and Chromium 150 is publicly disclosed in GHSA-g8qq-57p8-ggw5, materially raising exploitation risk for the narrower population of deployments with SVG animation enabled.

An attacker with contributor-level access submits a crafted SVG containing <animate attributeName="href" values="#safe;javascript:alert(document.cookie)" dur=".01s" fill="freeze"> to a form processed by a misconfigured sanitize-html instance. The leading #safe fragment satisfies the scheme check, the full values list is stored, and when a victim clicks the rendered link in the browser, the javascript: entry executes the attacker's script in the application's origin. A proof-of-concept reproducing this exact flow is included in the public GHSA advisory and was confirmed against sanitize-html 2.17.6 with Chromium 150.0.7871.124.