Is CVE-2026-33979 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33979 being exploited in the wild.

How severe is CVE-2026-33979?

Low severity, with a CVSS score of 3.1, published 27 March 2026.

Which products and versions are affected?

express-xss-sanitizer (npm) SEMVER:introduced=0,fixed=2.0.2.

Is there a fix for CVE-2026-33979?

Yes. express-xss-sanitizer (npm): upgrade to 2.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33979 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-33979?

Check whether you run express-xss-sanitizer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33979: express-xss-sanitizer configuration bypass leads to permissive HTML sanitization

CVE-2026-33979 · Severity: low · CVSS 3.1 · Published 2026-03-27

Express XSS Sanitizer is a Node.js middleware that strips dangerous HTML from user input to prevent cross-site scripting attacks. A flaw in versions up to 2.0.1 causes developer-configured "allow nothing" rules to be ignored, reverting to lenient tag/attribute filtering instead. Depending on how applications use the sanitized output, attackers could inject malicious links, HTML content, or XSS payloads that bypass the developer's intended security policy.

Technologies: express-xss-sanitizer (npm). Vendors: npm.

Quick answers

Is CVE-2026-33979 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33979 being exploited in the wild.
How severe is CVE-2026-33979?: Low severity, with a CVSS score of 3.1, published 27 March 2026.
Which products and versions are affected?: express-xss-sanitizer (npm) SEMVER:introduced=0,fixed=2.0.2.
Is there a fix for CVE-2026-33979?: Yes. express-xss-sanitizer (npm): upgrade to 2.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33979 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-33979?: Check whether you run express-xss-sanitizer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

express-xss-sanitizer (npm): upgrade to 2.0.2 or later
```
npm install express-xss-sanitizer@2.0.2
```

Technical details

This is a configuration validation bypass vulnerability in express-xss-sanitizer's sanitize() function. The root cause lies in validation logic that checks for array/object length (allowedTags.length > 0 and Object.keys(allowedAttributes).length > 0), treating empty configurations as "not provided" rather than explicit directives. When developers pass empty arrays/objects to enforce strict stripping, the library silently falls back to sanitize-html's default permissive configuration, allowing tags like <a>, <p>, <div> and attributes like href. The vulnerability requires no authentication or user interaction—an attacker with control over user input and knowledge of the vulnerable configuration can inject HTML/XSS. The fix (v2.0.2) now correctly respects explicitly provided empty configurations and passes them directly to the underlying sanitize-html library without override.

Affected products

Ahmed Adel Fahim express-xss-sanitizer <= 2.0.1

Identifiers

CVE-2026-33979
GHSA-3843-rr4g-m8jq

Timeline

2026-03-25: disclosed
2026-03-25: patched: Patch released in v2.0.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.