sanitize-html 2.13.0

Direct Vulnerabilities

Known vulnerabilities in the sanitize-html package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Cross-site Scripting (XSS) sanitize-html is a library that allows you to clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the SVG SMIL animation handling in `packages/sanitize-html/index.js`. An attacker can execute JavaScript in the application’s origin by supplying an allowed `<animate>` or `<set>` element with `attributeName="href"` or `xlink:href"` and a `values` list such as `#safe;javascript:...`, which bypasses the scheme policy because the sanitizer treats the list as a single flat URL. When a victim clicks the sanitized SVG link, the browser applies the animated `javascript:` destination after sanitization, exposing the application to script execution in user sessions. How to fix Cross-site Scripting (XSS)? Upgrade `sanitize-html` to version 2.17.7 or higher.	>=1.9.0 <2.17.7
M Cross-site Scripting (XSS) sanitize-html is a library that allows you to clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the `sanitizeHtml` function. An attacker can execute arbitrary scripts in the context of the user's browser by injecting specially crafted markup containing a literal solidus after a raw-text end-tag, which bypasses the intended sanitization and is interpreted as executable HTML by browsers. How to fix Cross-site Scripting (XSS)? Upgrade `sanitize-html` to version 2.17.6 or higher.	<2.17.6
M Cross-site Scripting (XSS) sanitize-html is a library that allows you to clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis Affected versions of this package are vulnerable to Cross-site Scripting (XSS) incomplete validation of URI schemes in attributes such as `action`, `formaction`, `data`, `poster`, and `background`. An attacker can execute arbitrary scripts in the context of the user’s browser by injecting a crafted `javascript:` URI into these attributes when they are allowed in the configuration. How to fix Cross-site Scripting (XSS)? Upgrade `sanitize-html` to version 2.17.5 or higher.	<2.17.5
M Improper Encoding or Escaping of Output sanitize-html is a library that allows you to clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the `linkHref` field handling. An attacker can execute arbitrary JavaScript by supplying a `javascript:` URL in an image widget's link URL field and having it rendered on the page. This affects users who can edit content and allows an attacker to run a script in viewers’ browsers, exposing session data and enabling unauthorized actions on the affected site. How to fix Improper Encoding or Escaping of Output? Upgrade `sanitize-html` to version 2.17.4 or higher.	<2.17.4
M Cross-site Scripting (XSS) sanitize-html is a library that allows you to clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the `xmp` raw-text passthrough. An attacker can execute arbitrary JavaScript in the browser of another user by submitting specially crafted HTML content that is sanitized and then rendered as trusted output. How to fix Cross-site Scripting (XSS)? Upgrade `sanitize-html` to version 2.17.4 or higher.	<2.17.4

Vulnerability

Vulnerable Version

Cross-site Scripting (XSS)