Skip to content
OpenAdvisories

Package · npm

sanitize-html

17 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.3
    CVE-2026-44990

    Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

    ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a …

    apostrophecms sanitize-html sanitize-html npm