Executive brief
sanitize-html is a widely-used Node.js library that removes potentially dangerous HTML and scripts from user-supplied content. When configured to allow certain HTML tags (nonTextTags), the library fails to properly escape HTML entities, allowing attackers to inject malicious JavaScript that will execute in the context of a user's browser. This can lead to account takeover, credential theft, or defacement depending on how the library is deployed.
Technical details
The vulnerability exists in the sanitize-html library's ontext() method, which processes text content within allowed tags. When a nonTextTag (such as textarea) is in the allowedTags configuration, the library pre-decodes HTML entities via htmlparser2, then fails to re-escape them before concatenating the text into the output. An attacker can exploit this by nesting specially-crafted HTML payloads that break out of the intended tag context and inject arbitrary HTML/JavaScript. The attack requires the victim application to use sanitize-html with at least one nonTextTag in the allowedTags option. The vulnerability was fixed in version 1.11.4.
Affected products
- npm sanitize-html <1.11.4
Timeline
- 2016-03-26: disclosed: Issue opened on GitHub
- 2017: patched: Fixed in version 1.11.4
- 2018-11-09: advisory: GHSA-xc6g-ggrc-qq4r published