# CVE-2016-1000237: ApostropheCMS sanitize-html Cross-Site Scripting via non-recursive filtering

Source: https://junglewise.ai/threats/cve-2016-1000237-apostrophecms-sanitize-html-cross-site-scripting-via-non  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-04-16. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2016-1000237 · Severity: low · CVSS 3.1 · Published 2020-04-16

A security vulnerability exists in sanitize-html, a popular tool used by web applications to clean user-provided content and prevent malicious code execution. Because the tool fails to clean input multiple times, an attacker can craft specially formatted text that bypasses security filters. If successful, this could allow an attacker to run unauthorized scripts in a user's browser, potentially leading to account takeover or the theft of sensitive information.

Technologies: [sanitize-html (npm)](https://junglewise.ai/threats/technologies/sanitize-html). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2016-1000237 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-1000237 being exploited in the wild.

**How severe is CVE-2016-1000237?** Low severity, with a CVSS score of 3.1, published 16 April 2020.

**Which products and versions are affected?** sanitize-html (npm) SEMVER:introduced=0,fixed=1.4.3.

**Is there a fix for CVE-2016-1000237?** Yes. sanitize-html (npm): upgrade to 1.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-1000237 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2016-1000237?** Check whether you run sanitize-html (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- sanitize-html (npm): upgrade to 1.4.3 or later

  ```sh
  npm install sanitize-html@1.4.3
  ```


## Technical details

The sanitize-html library before version 1.4.3 is vulnerable to Cross-Site Scripting (XSS) due to a lack of recursive sanitization. The parser fails to account for 'masking attacks' where malicious tags are nested within other tags (e.g., `<<img src="x"/>img src="x"/>`). When the outer tag is stripped, the inner malicious tag remains and is rendered by the browser. An unauthenticated remote attacker can exploit this by providing specially crafted HTML input to an application using this library. This allows for the execution of arbitrary JavaScript in the context of the victim's browser session. The issue was addressed in version 1.4.3 by implementing recursive invocation of the sanitization logic.

## Affected products

- ApostropheCMS sanitize-html < 1.4.3

## Identifiers

- CVE-2016-1000237
- GHSA-3j7m-hmh3-9jmp

## Timeline

- 2014-10-14: disclosed: Issue first reported on GitHub
- 2020-01-23: advisory: NVD published CVE-2016-1000237
- 2020-04-16: advisory: GitHub Advisory published

## References

- [https://github.com/apostrophecms/sanitize-html/issues/29](https://github.com/apostrophecms/sanitize-html/issues/29)
- [https://github.com/punkave/sanitize-html/issues/29](https://github.com/punkave/sanitize-html/issues/29)
- [https://github.com/apostrophecms/sanitize-html/commit/762fbc7bba389f3f789cc291c1eb2b64f60f2caf](https://github.com/apostrophecms/sanitize-html/commit/762fbc7bba389f3f789cc291c1eb2b64f60f2caf)
- [https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000237.json](https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000237.json)
- [https://www.npmjs.com/advisories/135](https://www.npmjs.com/advisories/135)

## Related threats

- [sanitize-html incomplete : meta refresh URL scheme bypass](https://junglewise.ai/threats/cve-2026-113661-apostrophecms-incomplete-meta-http-equiv-refresh-content-still)
- [ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)](https://junglewise.ai/threats/cve-2026-113657-apostrophecms-is-an-open-source-node-js-content-management)
- [sanitize-html noscript XSS bypass](https://junglewise.ai/threats/cve-2026-113654-apostrophecms-is-an-open-source-node-js-content-management)
- [sanitize-html unbounded recursion denial of service](https://junglewise.ai/threats/cve-2026-113650-apostrophecms-is-an-open-source-node-js-content-management)
- [sanitize-html stored XSS via SVG SMIL URI-list scheme bypass](https://junglewise.ai/threats/cve-2026-84371-sanitize-html-stored-xss-via-svg-smil-uri-list-scheme-bypass)