CVE-2026-63670: sanitize-html XSS bypass via textarea solidus close tag

CVE-2026-63670 · Severity: medium · CVSS 6.1 · Published 2026-08-17

sanitize-html is an HTML sanitization library used in many content management systems and form builders to prevent malicious code injection. This vulnerability allows attackers to inject executable JavaScript code (XSS) by exploiting a parser mismatch when textarea or xmp tags are allowed—a seemingly harmless configuration. An attacker can craft specially formatted input containing unescaped HTML that bypasses the sanitizer's allowlist, enabling cookie theft or session hijacking.

Technologies: sanitize-html (npm). Vendors: npm.

Quick answers

Is CVE-2026-63670 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63670 being exploited in the wild.
How severe is CVE-2026-63670?
Medium severity, with a CVSS score of 6.1, published 17 August 2026.
Which products and versions are affected?
sanitize-html (npm) <= 2.17.5, SEMVER:introduced=0,fixed=2.17.6.
Is there a fix for CVE-2026-63670?
Yes. sanitize-html (npm): upgrade to 2.17.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63670 attacked?
It is attacked over the network.
Am I affected by CVE-2026-63670?
Check whether you run sanitize-html (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • sanitize-html (npm): upgrade to 2.17.6 or later
    npm install sanitize-html@2.17.6

Technical details

The vulnerability arises from a parser differential between htmlparser2 (used by sanitize-html) and WHATWG-compliant browsers. When htmlparser2 encounters `</textarea/>` (with a solidus immediately following the tag name), it does not recognize it as a valid close tag, instead emitting it as raw text content. The ontext handler then appends this content via `result += text` without HTML escaping, assuming raw-text elements are already properly encoded. However, when a browser re-parses the sanitized output, it correctly interprets `</textarea/>` as a valid close tag, allowing subsequent HTML like `<img onerror=...>` to execute. This bypasses the allowlist because img and onerror are not in allowedTags. The vulnerability requires textarea or xmp in allowedTags and can be exploited via stored or reflected XSS. A fix is available in version 2.17.6, which either escapes textarea/xmp content via escapeHtml or corrects the htmlparser2 RCDATA end-tag tokenization.

Affected products

  • joomla sanitize-html <= 2.17.5

Identifiers

  • CVE-2026-63670
  • GHSA-jxwj-j7wr-gfrw

Timeline

  • 2026-08-12: disclosed
  • 2026-09-03: advisory
  • 2026-09-03: patched: Version 2.17.6 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.