CVE-2023-36823

Sanitize is an allowlist-based HTML and CSS sanitizer. Using carefully
crafted input, an attacker may be able to sneak arbitrary HTML and CSS
through Sanitize starting with version 3.0.0 and prior to version 6.0.2
when Sanitize is configured to use the built-in “relaxed” config or when
using a custom config that allows style elements and one or more CSS
at-rules. This could result in cross-site scripting or other undesired
behavior when the malicious HTML and CSS are rendered in a browser.
Sanitize 6.0.2 performs additional escaping of CSS in style element
content, which fixes this issue. Users who are unable to upgrade can
prevent this issue by using a Sanitize config that doesn’t allow style
elements, using a Sanitize config that doesn’t allow CSS at-rules, or by
manually escaping the character sequence </ as <\/ in style element
content.