HIGH8.2npm
GHSA-3843-rr4g-m8jq· CVE-2026-33979Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)
Modified: 3/30/2026
package
npm/express-xss-sanitizer
pkg:npm/express-xss-sanitizer
MEDIUM6.1npm
GHSA-grjp-4jmr-mjcw· CVE-2022-21169express-xss-sanitizer vulnerable to Prototype Pollution via allowedTags attribute
Modified: 11/8/2023
MEDIUMnpm
GHSA-hvq2-wf92-j4f3· CVE-2025-59364express-xss-sanitizer has an unbounded recursion depth
Modified: 9/26/2025