CVE-2019-25225

sanitize-html is vulnerable to XSS through incomprehensive sanitization

6.1 MediumFix available

sanitize-html prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The sanitizeHtml() function in index.js does not sanitize content when using the custom transformTags option, which is intended to convert attribute values into text. As a result, malicious input can be transformed into executable code.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.27%Up 0.2 points since Sep 8, 2025

What each source reports

CVE List Score used 6.1

Record: CVE-2019-25225
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2019-19375 6.1

Record: EUVD-2019-19375
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-qhxp-v273-g94h 6.1

sanitize-html is vulnerable to XSS through incomprehensive sanitization

Record: GHSA-qhxp-v273-g94h
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

NVD 6.1

Record: CVE-2019-25225
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 6.1

Record: CVE-2019-25225
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVGHSA-qhxp-v273-g94h 6.1

sanitize-html is vulnerable to XSS through incomprehensive sanitization

Record: GHSA-qhxp-v273-g94h
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVUBUNTU-CVE-2019-25225 6.1

Record: UBUNTU-CVE-2019-25225
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVCLSA-2026-1775003160 No score

TuxCare security update for sanitize-html (1 CVE)

TuxCare rebuilt sanitize-html to address 1 CVE. Fixed in 1.27.5-tuxcare.1.

Record: CLSA-2026-1775003160
Updated: 2026-11-02

OSVROOT-APP-NPM-CVE-2019-25225 No score

CVE-2019-25225 in @rootio/sanitize-html - Patched by Root

Root has patched CVE-2019-25225 in the @rootio/sanitize-html package for Root:npm. Multiple fixed versions available.

Record: ROOT-APP-NPM-CVE-2019-25225
Updated: 2026-11-02

Affected products

apostrophecms sanitize-html

Affected packages

Affected packages
Package	Affected	Fixed
`sanitize-html` npm	before 2.0.0-beta	2.0.0-beta
`sanitize-html` TuxCare:npm	1.27.5-tuxcare.0 up to 1.27.5-tuxcare.1, plus listed versions 1.27.5	1.27.5-tuxcare.1
`@rootio/sanitize-html` Root:npm	before 1.4.2-root.io.6	1.4.2-root.io.61.4.2-root.io.71.4.2-root.io.81.4.2-root.io.9
`sanitize-html` Root:npm	before 1.4.2-aikido.9	1.4.2-aikido.9
`node-sanitize-html` Ubuntu:22.04:LTS	All versions, plus listed versions 2.6.1-1	None known
`node-sanitize-html` Ubuntu:24.04:LTS	All versions, plus listed versions 2.8.0+~2.6.2-1	None known
`node-sanitize-html` Ubuntu:25.10	All versions, plus listed versions 2.14.0+~2.13.0-1	None known
`node-sanitize-html` Ubuntu:26.10	All versions, plus listed versions 2.14.0+~2.13.0-12.17.0+~2.16.1-1	None known
`node-sanitize-html` Ubuntu:26.04:LTS	All versions, plus listed versions 2.14.0+~2.13.0-1	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-25225 is a medium vulnerability (CVSS 6.1) in Apostrophecms Sanitize-html, published September 8, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 19th percentile. Fixed in sanitize-html 2.0.0-beta.