sanitize-html vulnerabilities (npm)
17 vulnerabilities.
-
sanitize-htmlnpm ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs 5.4 Medium -
sanitize-htmlnpm ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS) 3.7 Low -
sanitize-htmlnpm ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render 5.3 Medium -
sanitize-htmlnpm ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced) 5.3 Medium -
sanitize-htmlnpm ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass 5.4 Medium -
sanitize-htmlnpm ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close 6.1 Medium -
sanitize-htmlnpm sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and background attributes 5.4 Medium -
sanitize-htmlnpm Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` 9.3 Critical -
sanitize-htmlnpm ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements 6.1 Medium -
sanitize-htmlnpm sanitize-html is vulnerable to XSS through incomprehensive sanitization 6.1 Medium -
sanitize-htmlnpm sanitize-html Information Exposure vulnerability 5.3 Medium -
sanitize-htmlnpm Regular Expression Denial of Service (ReDoS) 5.3 Medium -
sanitize-htmlnpm Improper Input Validation in sanitize-html 5.3 Medium -
sanitize-htmlnpm Improper Input Validation in sanitize-html 5.3 Medium -
sanitize-htmlnpm Cross-Site Scripting in sanitize-html 6.1 Medium -
sanitize-htmlnpm Cross-Site Scripting in sanitize-html 6.1 Medium -
sanitize-htmlnpm Cross-Site Scripting in sanitize-html 6.1 Medium