Executive brief
sanitize-html is a widely-used Node.js library that filters HTML to prevent injection attacks. When applications allow SVG animations, this library fails to recognize that the `values` attribute in SMIL animation elements can contain a semicolon-separated list of URLs. An attacker can bypass the configured scheme policy by prefixing a malicious JavaScript URL with a safe fragment (e.g., `#safe;javascript:...`), allowing stored XSS when a victim interacts with the animated link. This affects applications that accept user-provided SVG content and rely on sanitize-html's filtering.
Technical details
This is a stored cross-site scripting (XSS) vulnerability (CWE-79) in the sanitize-html library's SVG sanitization logic. The root cause is in `index.js:371-383`, where the library validates URL attributes as flat strings without recognizing SMIL URI-list semantics. When an SVG `animate` element has `attributeName="href"` (or `xlink:href`), the sibling `values` attribute is interpreted by browsers as a semicolon-separated list of URLs per SMIL specification. The vulnerability allows an attacker to inject a payload like `values="#safe;javascript:alert('XSS')"` that bypasses the scheme check: the leading `#safe` fragment passes validation, but the complete list including `javascript:` is retained in the sanitized output. When a victim clicks the animated link, the browser executes the JavaScript in the application's origin. Exploitation requires that the application configures sanitize-html to allow SVG and `animate` tags, and applies a scheme policy to `values` (which should block `javascript:`). A patch was released in version 2.17.7; affected versions are 1.9.0 through 2.17.6.
Affected products
- npm sanitize-html >=1.9.0, <=2.17.6
Timeline
- 2026-09-01: disclosed: GHSA-g8qq-57p8-ggw5 and CVE-2026-84371 published
- 2026-09-01: patched: Patched in sanitize-html 2.17.7