MEDIUM6.1npm
GHSA-3j7m-hmh3-9jmp· CVE-2016-1000237Cross-Site Scripting in sanitize-html
Modified: 11/8/2023
package
npm/sanitize-html
pkg:npm/sanitize-html
MEDIUM6.1npm
GHSA-9mrh-v2v3-xpfm· CVE-2026-40186sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements
Modified: 4/16/2026
HIGH7.5npm
GHSA-cgfm-xwp7-2cvr· CVE-2022-25887Sanitize-html Vulnerable To REDoS Attacks
Modified: 4/22/2024
MEDIUM5.4npm
GHSA-g8qq-57p8-ggw5· CVE-2026-84371ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass
Modified: 9/10/2026
MEDIUM6.1npm
GHSA-jxwj-j7wr-gfrw· CVE-2026-63670ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close
Modified: 9/3/2026
MEDIUM5.3npm
GHSA-mjxr-4v3x-q3m4· CVE-2021-26540Improper Input Validation in sanitize-html
Modified: 11/8/2023
MEDIUM6.1npm
GHSA-qhxp-v273-g94h· CVE-2019-25225sanitize-html is vulnerable to XSS through incomprehensive sanitization
Modified: 9/12/2025
MEDIUM5.3npm
GHSA-rjqq-98f6-6j3r· CVE-2021-26539Improper Input Validation in sanitize-html
Modified: 11/8/2023
MEDIUM5.3npm
GHSA-rm97-x556-q36h· CVE-2024-21501sanitize-html Information Exposure vulnerability
Modified: 9/10/2026
CRITICAL9.3npm
GHSA-rpr9-rxv7-x643· CVE-2026-44990Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`
Modified: 6/12/2026
MEDIUM5.4npm
GHSA-vccv-cmxp-4j9h· CVE-2026-53606sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes
Modified: 7/31/2026
MEDIUM6.1npm
GHSA-wg96-3933-j2w5· CVE-2017-16017Cross-Site Scripting in sanitize-html
Modified: 11/8/2023
MEDIUMnpm
GHSA-xc6g-ggrc-qq4r· CVE-2017-16016Cross-Site Scripting in sanitize-html
Modified: 11/8/2023