{"id":"CVE-2017-16016","aliases":["EUVD-2018-0787","GHSA-xc6g-ggrc-qq4r","ROOT-APP-NPM-CVE-2017-16016"],"status":"published","title":"Cross-Site Scripting in sanitize-html","description":"Sanitize-html is a library for scrubbing html input of malicious values. Versions 1.11.1 and below are vulnerable to cross site scripting (XSS) in certain scenarios: If allowed at least one nonTextTags, the result is a potential XSS vulnerability.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01336,"percentile":0.71425,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2018-06-04T19:00:00Z","modified":"2026-10-20T10:48:16Z","fixes":[{"ecosystem":"npm","package":"sanitize-html","fixed_in":["1.11.4"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"@rootio/sanitize-html","fixed_in":["1.4.2-root.io.5","1.4.2-root.io.6","1.4.2-root.io.7","1.4.2-root.io.8","1.4.2-root.io.9"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"sanitize-html","fixed_in":["1.4.2-aikido.9"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"sanitize-html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.11.1"},{"fixed":"1.11.4"}]}]},{"source":"osv","ecosystem":"npm","package":"sanitize-html","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.11.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/sanitize-html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-root.io.5"},{"fixed":"1.4.2-root.io.6"},{"fixed":"1.4.2-root.io.7"},{"fixed":"1.4.2-root.io.8"},{"fixed":"1.4.2-root.io.9"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"sanitize-html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-aikido.9"}]}]}],"products":[{"vendor":"hackerone","product":"sanitize-html node module"},{"vendor":"punkave","product":"sanitize-html"}],"references":[{"url":"https://nodesecurity.io/advisories/154","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://github.com/punkave/sanitize-html/issues/100","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://github.com/punkave/sanitize-html/commit/5d205a1005ba0df80e21d8c64a15bb3accdb2403","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-16016","tags":["advisory"]},{"url":"https://github.com/punkave/sanitize-html/commit/5d205a1005ba0df80e21d8c64a15bb3accdb2403)))","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xc6g-ggrc-qq4r","tags":["advisory"]},{"url":"https://npmjs.com/package/sanitize-html#discarding-the-entire-contents-of-a-disallowed-tag","tags":["web"]},{"url":"https://www.npmjs.com/advisories/154","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-16016","description":"Sanitize-html is a library for scrubbing html input of malicious values. Versions 1.11.1 and below are vulnerable to cross site scripting (XSS) in certain scenarios: If allowed at least one nonTextTags, the result is a potential XSS vulnerability.","status":"published","published":"2018-06-04T19:00:00Z","modified":"2024-09-17T01:46:48.797Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:33:21.453505Z"}],"euvd":[{"id":"EUVD-2018-0787","description":"Sanitize-html is a library for scrubbing html input of malicious values. Versions 1.11.1 and below are vulnerable to cross site scripting (XSS) in certain scenarios: If allowed at least one nonTextTags, the result is a potential XSS vulnerability.","status":"published","published":"2018-06-04T19:00:00Z","modified":"2024-09-17T01:46:48Z","updated_at":"2026-11-03T00:28:46.561775Z"}],"ghsa":[{"id":"GHSA-xc6g-ggrc-qq4r","title":"Cross-Site Scripting in sanitize-html","description":"Affected versions of `sanitize-html` are vulnerable to cross-site scripting when allowedTags includes at least one `nonTextTag`.\n\n## Proof of Concept\n\n```js\nvar sanitizeHtml = require('sanitize-html');\n\nvar dirty = '!\u003ctextarea\u003e\u0026lt;/textarea\u0026gt;\u003csvg/onload=prompt`xs`\u0026gt;\u003c/textarea\u003e!';\nvar clean = sanitizeHtml(dirty, {\n    allowedTags: [ 'textarea' ]\n});\n\nconsole.log(clean);\n\n// !\u003ctextarea\u003e\u003c/textarea\u003e\u003csvg/onload=prompt`xs`\u003e\u003c/textarea\u003e!\n```\n\n\n## Recommendation\n\nUpdate to version 1.11.4 or later.","status":"published","published":"2018-11-09T17:47:23Z","modified":"2023-09-08T23:04:55Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:03.916765Z"}],"nvd":[{"id":"CVE-2017-16016","description":"Sanitize-html is a library for scrubbing html input of malicious values. Versions 1.11.1 and below are vulnerable to cross site scripting (XSS) in certain scenarios: If allowed at least one nonTextTags, the result is a potential XSS vulnerability.","status":"published","published":"2018-06-04T19:29:01.023Z","modified":"2026-06-17T01:08:38.803Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:04:17.638656Z"}],"osv":[{"id":"CVE-2017-16016","description":"Sanitize-html is a library for scrubbing html input of malicious values. Versions 1.11.1 and below are vulnerable to cross site scripting (XSS) in certain scenarios: If allowed at least one nonTextTags, the result is a potential XSS vulnerability.","status":"published","published":"2018-06-04T19:29:01.023Z","modified":"2026-10-20T10:48:16.218339919Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:04.853379Z"},{"id":"GHSA-xc6g-ggrc-qq4r","title":"Cross-Site Scripting in sanitize-html","description":"Affected versions of `sanitize-html` are vulnerable to cross-site scripting when allowedTags includes at least one `nonTextTag`.\n\n## Proof of Concept\n\n```js\nvar sanitizeHtml = require('sanitize-html');\n\nvar dirty = '!\u003ctextarea\u003e\u0026lt;/textarea\u0026gt;\u003csvg/onload=prompt`xs`\u0026gt;\u003c/textarea\u003e!';\nvar clean = sanitizeHtml(dirty, {\n    allowedTags: [ 'textarea' ]\n});\n\nconsole.log(clean);\n\n// !\u003ctextarea\u003e\u003c/textarea\u003e\u003csvg/onload=prompt`xs`\u003e\u003c/textarea\u003e!\n```\n\n\n## Recommendation\n\nUpdate to version 1.11.4 or later.","status":"published","published":"2018-11-09T17:47:23Z","modified":"2023-11-08T03:58:59.829428Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:59.835583Z"},{"id":"ROOT-APP-NPM-CVE-2017-16016","title":"CVE-2017-16016 in @rootio/sanitize-html - Patched by Root","description":"Root has patched CVE-2017-16016 in the @rootio/sanitize-html package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-06-04T20:57:52Z","modified":"2026-06-05T01:30:35.440798697Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}