AIKIDO-2026-932704
sanitize-html is vulnerable to Cross-Site Scripting (XSS)
31
Low Risk
This Affects:
sanitize-htmlTL;DR
sanitize-html keeps a discard region for non-text tags such as script and ends that region on an implied close. A browser continues to discard content past that point for certain nested tag combinations. Markup that uses this mismatch can get a <noscript> tag's content past the discard logic, so the browser shows content that should have been dropped. The fix ends the discard region at the implied close a browser uses.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
sanitize-html is vulnerable to Cross-Site Scripting (XSS) in versions 0.0.1 - 2.17.7.
How to fix this
Upgrade the sanitize-html library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.