Sanitize Html
Monthly
Stored cross-site scripting can occur in sites using sanitize-html before 2.18.0 when a non-default allow-list permits meta refresh elements and their http-equiv/content attributes, because unsafe script or redirect destinations in the refresh value are retained. ApostropheCMS deployments that bundle the affected library are in scope, but default sanitize-html configurations are not affected; exploitation requires an account able to submit content and a victim who renders it. The issue is fixed in sanitize-html 2.18.0, and no public exploit was identified at time of analysis.
sanitize-html 2.17.7 and later before 2.18.0 can bypass SMIL URL protection when an application opts into a non-default allow-list that permits namespace-prefixed SVG animation elements plus URL-targeting attributes. The prefixed animation tags do not match the library's unprefixed animation-element check, so a sanitized SVG can rewrite a link destination to an unsafe URI and execute script if a user activates that link. The default configuration is not unconditionally affected, exploitation requires content-submission access and a victim click, and the issue is fixed in sanitize-html 2.18.0; no public exploit code was identified at time of analysis.
Stored cross-site scripting in sanitize-html before 2.18.0 occurs only when the sanitizer is configured with a non-default nonTextTags option that includes noscript; default configurations and other default nonTextTags elements are not affected. In ApostropheCMS, an authenticated low-privilege content author can submit crafted HTML that survives sanitization and executes when a victim later views it in a scripting-enabled browser, yielding limited client-side impact (assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N; CVSS 4.0 base 5.3, Medium). No public exploit was identified at time of analysis.
Unbounded recursive re-sanitization in sanitize-html 2.18.0 allows remote attackers to exhaust the Node.js call stack and crash the process by submitting HTML containing a disallowed <iframe> with deeply nested raw-text content. The flaw triggers only under the library defaults - <iframe> absent from allowedTags and disallowedTagsMode set to 'discard' - which means most unmodified deployments, including ApostropheCMS installations that route untrusted HTML through the sanitizer, are exposed. Impact is limited to availability (CVSS 5.3, A:L only, PR:N/AC:L/UI:N) with no confidentiality or integrity effect, and no public exploit code or CISA KEV active-exploitation entry was identified at time of analysis.
Cross-site scripting in sanitize-html prior to 2.17.5 allows low-privileged attackers to inject executable `javascript:` URIs through HTML attributes that the library's scheme-blocking logic never inspects. The `naughtyHref()` function gates dangerous URI schemes only for attributes listed in `allowedSchemesAppliedToAttributes` (defaulting to `href`, `src`, and `cite`), leaving attributes such as `action`, `formaction`, `data`, `poster`, `background`, `ping`, `xlink:href`, `dynsrc`, and `lowsrc` entirely unchecked. Applications that explicitly permit any of these attributes in their sanitize-html configuration are vulnerable; no public exploit code has been identified at time of analysis, and this CVE is not currently listed in CISA KEV.
Cross-site scripting (XSS) in ApostropheCMS 4.28.0 and sanitize-html 2.17.1 allows remote attackers to bypass HTML tag filtering and inject arbitrary tags through entity-encoded payloads in textarea and option elements. A regression in the sanitize-html parser incorrectly assumes htmlparser2 does not decode entities within non-text elements, causing encoded HTML to be decoded and written directly to output without sanitization. Exploitation requires non-default configurations where textarea or option tags are in the allowedTags list, commonly found in form builders, and user interaction to submit form content. No active exploitation has been identified at time of analysis, but the vulnerability is trivial to exploit once configuration conditions are met.
'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
`sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Stored cross-site scripting can occur in sites using sanitize-html before 2.18.0 when a non-default allow-list permits meta refresh elements and their http-equiv/content attributes, because unsafe script or redirect destinations in the refresh value are retained. ApostropheCMS deployments that bundle the affected library are in scope, but default sanitize-html configurations are not affected; exploitation requires an account able to submit content and a victim who renders it. The issue is fixed in sanitize-html 2.18.0, and no public exploit was identified at time of analysis.
sanitize-html 2.17.7 and later before 2.18.0 can bypass SMIL URL protection when an application opts into a non-default allow-list that permits namespace-prefixed SVG animation elements plus URL-targeting attributes. The prefixed animation tags do not match the library's unprefixed animation-element check, so a sanitized SVG can rewrite a link destination to an unsafe URI and execute script if a user activates that link. The default configuration is not unconditionally affected, exploitation requires content-submission access and a victim click, and the issue is fixed in sanitize-html 2.18.0; no public exploit code was identified at time of analysis.
Stored cross-site scripting in sanitize-html before 2.18.0 occurs only when the sanitizer is configured with a non-default nonTextTags option that includes noscript; default configurations and other default nonTextTags elements are not affected. In ApostropheCMS, an authenticated low-privilege content author can submit crafted HTML that survives sanitization and executes when a victim later views it in a scripting-enabled browser, yielding limited client-side impact (assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N; CVSS 4.0 base 5.3, Medium). No public exploit was identified at time of analysis.
Unbounded recursive re-sanitization in sanitize-html 2.18.0 allows remote attackers to exhaust the Node.js call stack and crash the process by submitting HTML containing a disallowed <iframe> with deeply nested raw-text content. The flaw triggers only under the library defaults - <iframe> absent from allowedTags and disallowedTagsMode set to 'discard' - which means most unmodified deployments, including ApostropheCMS installations that route untrusted HTML through the sanitizer, are exposed. Impact is limited to availability (CVSS 5.3, A:L only, PR:N/AC:L/UI:N) with no confidentiality or integrity effect, and no public exploit code or CISA KEV active-exploitation entry was identified at time of analysis.
Cross-site scripting in sanitize-html prior to 2.17.5 allows low-privileged attackers to inject executable `javascript:` URIs through HTML attributes that the library's scheme-blocking logic never inspects. The `naughtyHref()` function gates dangerous URI schemes only for attributes listed in `allowedSchemesAppliedToAttributes` (defaulting to `href`, `src`, and `cite`), leaving attributes such as `action`, `formaction`, `data`, `poster`, `background`, `ping`, `xlink:href`, `dynsrc`, and `lowsrc` entirely unchecked. Applications that explicitly permit any of these attributes in their sanitize-html configuration are vulnerable; no public exploit code has been identified at time of analysis, and this CVE is not currently listed in CISA KEV.
Cross-site scripting (XSS) in ApostropheCMS 4.28.0 and sanitize-html 2.17.1 allows remote attackers to bypass HTML tag filtering and inject arbitrary tags through entity-encoded payloads in textarea and option elements. A regression in the sanitize-html parser incorrectly assumes htmlparser2 does not decode entities within non-text elements, causing encoded HTML to be decoded and written directly to output without sanitization. Exploitation requires non-default configurations where textarea or option tags are in the allowedTags list, commonly found in form builders, and user interaction to submit form content. No active exploitation has been identified at time of analysis, but the vulnerability is trivial to exploit once configuration conditions are met.
'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
`sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.