225 matches found
ROOT-APP-NPM-CVE-2017-16016 CVE-2017-16016 in @rootio/sanitize-html - Patched by Root
Root has patched CVE-2017-16016 in the @rootio/sanitize-html package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2016-1000237 CVE-2016-1000237 in @rootio/sanitize-html - Patched by Root
Root has patched CVE-2016-1000237 in the @rootio/sanitize-html package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2021-26540 CVE-2021-26540 in @rootio/sanitize-html - Patched by Root
Root has patched CVE-2021-26540 in the @rootio/sanitize-html package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2019-25225 CVE-2019-25225 in @rootio/sanitize-html - Patched by Root
Root has patched CVE-2019-25225 in the @rootio/sanitize-html package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2024-21501 CVE-2024-21501 in @rootio/sanitize-html - Patched by Root
Root has patched CVE-2024-21501 in the @rootio/sanitize-html package for Root:npm. Multiple fixed versions available...
PT-2026-49160
Root has patched NSWG-ECO-154 in the @rootio/sanitize-html package for Root:npm. Multiple fixed versions available...
org.webjars.npm:github-com-daichirata-vue-sanitize (0.2.2), org.webjars.npm:github-com-daichirata-vue-sanitize- (0.2.2) potentially affected by CVE-2026-45011 via org.webjars.npm:sanitize-html (2.7.0)
org.webjars.npm:sanitize-html MAVEN version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:sanitize-html and may be impacted: - org.webjars.npm:github-com-daichirata-vue-sanitize 0.2.2 -...
7ghost (>=4.11.0, <=4.11.46), @21epub/text-block (>=0.0.1, <=1.2.1) +1867 more potentially affected by CVE-2026-45011 via sanitize-html (>=2.1.0, <=2.17.3)
sanitize-html NPM version =2.1.0, =4.11.0, =0.0.1, =5.0.2, =0.0.1, =1.0.0, =3.0.0, =1.3.0, =1.0.0, =0.2.0-a0, =1.0.0, =3.7.0, =3.19.3 and more Source cves: CVE-2026-45011 Source advisory: SNYK:JS-SANITIZEHTML-16759743...
Improper Encoding or Escaping of Output
Overview sanitize-html is a library that allows you to clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the linkHref field handling. An...
Cross-site Scripting (XSS)
Overview sanitize-html is a library that allows you to clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis Affected versions of this package are vulnerable to Cross-site Scripting XSS via the xmp raw-text passthrough. An attacker can...
GHSA-RPR9-RXV7-X643 Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`
Summary Under the default configuration, sanitize-html can turn attacker-controlled content inside a disallowed xmp element into live HTML or JavaScript. This is a sanitizer bypass in the default disallowedTagsMode: 'discard' path and can lead to stored XSS in applications that render sanitized...
7ghost (>=4.11.0, <=4.11.46), @21epub/text-block (>=0.0.1, <=1.2.1) +1867 more potentially affected by CVE-2026-44990 via sanitize-html (>=2.1.0, <=2.17.3)
sanitize-html NPM version =2.1.0, =4.11.0, =0.0.1, =5.0.2, =0.0.1, =1.0.0, =3.0.0, =1.3.0, =1.0.0, =0.2.0-a0, =1.0.0, =3.7.0, =3.19.3 and more Source cves: CVE-2026-44990 Source advisory: SNYK:JS-SANITIZEHTML-16697325...
NPM: Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`
NPM: Apostrophe has default XSS via xmp raw-text passthrough in sanitize-html vulnerability discovered by ? in WordPress Npm sanitize-html versions 2.17.3...
@nivinjoseph/n-config (2.0.4), @nivinjoseph/n-data (4.0.3) +53 more potentially affected by CVE-2026-44990 via sanitize-html (2.17.3)
sanitize-html NPM version 2.17.3 is affected by a known vulnerability. The following packages have a transitive dependency on sanitize-html and may be impacted: - @nivinjoseph/n-config 2.0.4 - @nivinjoseph/n-data 4.0.3 - @nivinjoseph/n-date 1.0.1 - @nivinjoseph/n-domain 3.0.6 - @nivinjoseph/n-eda...
org.webjars.npm:github-com-daichirata-vue-sanitize (0.2.2), org.webjars.npm:github-com-daichirata-vue-sanitize- (0.2.2) potentially affected by CVE-2026-44990 via org.webjars.npm:sanitize-html (2.7.0)
org.webjars.npm:sanitize-html MAVEN version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:sanitize-html and may be impacted: - org.webjars.npm:github-com-daichirata-vue-sanitize 0.2.2 -...
Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`
Summary Under the default configuration, sanitize-html can turn attacker-controlled content inside a disallowed xmp element into live HTML or JavaScript. This is a sanitizer bypass in the default disallowedTagsMode: 'discard' path and can lead to stored XSS in applications that render sanitized...
PT-2026-41152
Name of the Vulnerable Software and Affected Versions sanitize-html version 2.17.3 Description A sanitizer bypass exists in the default configuration where the disallowedTagsMode: 'discard' path fails to properly handle the xmp element. Because xmp is not included in the nonTextTags list, its...
011xwztpjn (1.0.0), 02y9dg4qm3 (1.0.0) +11501 more potentially affected by CVE-2026-41239 via dompurify (>=1.0.10, <=3.3.3)
dompurify NPM version =1.0.10, =3.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on dompurify and may be impacted: - 011xwztpjn 1.0.0 - 02y9dg4qm3 1.0.0 - 04tw75kmd9 1.0.0 - 0650teqqly 1.0.0 - 097oi25ils 1.0.0 - 0a0fpniotn 1.0.0 - 0c7j76u46q 1.0.0 -...
1router (>=0.3.96, <=1.0.2), 8router (>=0.5.12, <=0.5.24) +2123 more potentially affected by CVE-2026-41238 via dompurify (>=3.0.1, <=3.3.3)
dompurify NPM version =3.0.1, =0.3.96, =0.5.12, =0.3.33, =0.5.0, =0.4.71, =1.0.0, =1.5.1, =0.18.0-beta.0, =0.1.0-alpha.1, =0.1.0, =0.1.0, =0.0.0-dev-20240828032938, =0.2.8-experimental.0, =0.2.10 and more Source cves: CVE-2026-41238 Source advisory: SNYK:JS-DOMPURIFY-16132234...
