Skip to content
OpenAdvisories

Product · cstigler

node-xhtml-purifier

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.1
    CVE-2026-61784

    xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS

    xhtml-purifier is a Node.js library to take in raw/unknown/untrusted HTML and output cleaned, purified, trusted HTML. Versions prior to 0.4.3 do not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString() (XHTMLPurifier…

    cstigler node-xhtml-purifier xhtml-purifier npm