Executive brief
sanitize-html is an HTML sanitization library used in many content management systems and form builders to prevent malicious code injection. This vulnerability allows attackers to inject executable JavaScript code (XSS) by exploiting a parser mismatch when textarea or xmp tags are allowed—a seemingly harmless configuration. An attacker can craft specially formatted input containing unescaped HTML that bypasses the sanitizer's allowlist, enabling cookie theft or session hijacking.
Technical details
The vulnerability arises from a parser differential between htmlparser2 (used by sanitize-html) and WHATWG-compliant browsers. When htmlparser2 encounters `</textarea/>` (with a solidus immediately following the tag name), it does not recognize it as a valid close tag, instead emitting it as raw text content. The ontext handler then appends this content via `result += text` without HTML escaping, assuming raw-text elements are already properly encoded. However, when a browser re-parses the sanitized output, it correctly interprets `</textarea/>` as a valid close tag, allowing subsequent HTML like `<img onerror=...>` to execute. This bypasses the allowlist because img and onerror are not in allowedTags. The vulnerability requires textarea or xmp in allowedTags and can be exploited via stored or reflected XSS. A fix is available in version 2.17.6, which either escapes textarea/xmp content via escapeHtml or corrects the htmlparser2 RCDATA end-tag tokenization.
Affected products
- joomla sanitize-html <= 2.17.5
Timeline
- 2026-08-12: disclosed
- 2026-09-03: advisory
- 2026-09-03: patched: Version 2.17.6 released