# CVE-2017-16017: sanitize-html cross-site scripting

Source: https://junglewise.ai/threats/cve-2017-16017-sanitize-html-cross-site-scripting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2018-11-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2017-16017 · Severity: low · CVSS 3 · Published 2018-11-09

sanitize-html is a Node.js library used to remove potentially harmful HTML from user-supplied content, protecting web applications from malicious scripts. A flaw in its HTML parsing logic fails to properly sanitize certain malformed tags, allowing attackers to inject executable JavaScript code that runs in users' browsers. This could lead to session hijacking, credential theft, or malware distribution through affected websites.

Technologies: [sanitize-html (npm)](https://junglewise.ai/threats/technologies/sanitize-html). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2017-16017 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-16017 being exploited in the wild.

**How severe is CVE-2017-16017?** Low severity, with a CVSS score of 3, published 9 November 2018.

**Which products and versions are affected?** sanitize-html (npm) < 1.2.3.

**Is there a fix for CVE-2017-16017?** A patch was published on 2017: Fixed in version 1.2.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2017-16017 attacked?** It is attacked over the network.

**Am I affected by CVE-2017-16017?** Check whether you run sanitize-html (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a cross-site scripting (CWE-79) flaw caused by improper handling of malformed HTML attributes during parsing. When processing tags with invalid attribute syntax (e.g., `&lt;IMG SRC= onmouseover="alert('XSS');"&gt;`), the parser incorrectly interprets the injected attribute as a quoted value rather than filtering it, resulting in the browser executing the embedded script. The attack requires no authentication and is triggered via user interaction (rendering the malicious HTML in a browser). Affected versions prior to 1.2.3 do not properly strip the event handler, leaving XSS payloads intact. A patch is available in version 1.2.3 and later.

## Affected products

- npm sanitize-html < 1.2.3

## Identifiers

- CVE-2017-16017
- GHSA-wg96-3933-j2w5

## Timeline

- 2018-11-09: disclosed
- 2017: patched: Fixed in version 1.2.3

## References

- [https://github.com/punkave/sanitize-html/issues/19](https://github.com/punkave/sanitize-html/issues/19)

## Related threats

- [sanitize-html incomplete : meta refresh URL scheme bypass](https://junglewise.ai/threats/cve-2026-113661-apostrophecms-incomplete-meta-http-equiv-refresh-content-still)
- [ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)](https://junglewise.ai/threats/cve-2026-113657-apostrophecms-is-an-open-source-node-js-content-management)
- [sanitize-html noscript XSS bypass](https://junglewise.ai/threats/cve-2026-113654-apostrophecms-is-an-open-source-node-js-content-management)
- [sanitize-html unbounded recursion denial of service](https://junglewise.ai/threats/cve-2026-113650-apostrophecms-is-an-open-source-node-js-content-management)
- [sanitize-html stored XSS via SVG SMIL URI-list scheme bypass](https://junglewise.ai/threats/cve-2026-84371-sanitize-html-stored-xss-via-svg-smil-uri-list-scheme-bypass)