pkg:npm/sanitize-html

All known vulnerabilities

• CRITICAL9.3CVE-2026-44990Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`
  >= 2.17.3, < 2.17.4
• HIGH7.5CVE-2022-25887Sanitize-html Vulnerable To REDoS Attacks
  from 0, < 2.7.1
• MEDIUM6.1CVE-2026-40186sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements
  >= 2.17.2, < 2.17.3
• MEDIUM6.1sanitize-html is vulnerable to XSS through incomprehensive sanitization
  from 0, < 2.0.0-beta
• MEDIUM6.1Cross-Site Scripting in sanitize-html
  from 0, < 1.4.3
• MEDIUM6.1Cross-Site Scripting in sanitize-html
  from 0, < 1.2.3
• MEDIUM5.3sanitize-html Information Exposure vulnerability
  from 0, < 2.12.1
• MEDIUM5.3Improper Input Validation in sanitize-html
  from 0, < 2.3.2
• MEDIUM5.3Improper Input Validation in sanitize-html
  from 0, < 2.3.1
• —Cross-Site Scripting in sanitize-html
  from 0, < 1.11.4