Executive brief
A vulnerability in the sanitize-html library allows attackers to bypass security filters and inject malicious scripts into web applications. This occurs when the library is configured to allow certain form-related tags like text areas or dropdown options. An exploit could lead to cross-site scripting (XSS), allowing attackers to steal user session data or perform unauthorized actions on behalf of users.
Technical details
A regression introduced in commit 49d0bb7 causes sanitize-html to skip HTML escaping for text content within elements defined in nonTextTagsArray (specifically <textarea> and <option>). The library incorrectly assumes that the underlying parser (htmlparser2) does not decode entities in these contexts; however, htmlparser2 10.x does decode them. Consequently, an attacker can provide entity-encoded payloads (e.g., <script>) which are decoded by the parser and then written directly to the output without being re-escaped. This allows for complete bypass of the allowedTags enforcement and enables stored XSS. The vulnerability is present in version 2.17.2 and is fixed in version 2.17.3.
Affected products
- apostrophecms sanitize-html >= 2.17.2, < 2.17.3
Timeline
- 2026-04-15: disclosed
- 2026-04-15: patched
- 2026-04-16: advisory