CVE-2021-26540: Improper Input Validation in sanitize-html
Summary
CVE-2021-26540: Improper Input Validation in sanitize-html. Affects sanitize-html versions < 2.3.2. Fixed in 2.3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The sanitize-html package is an npm package that provides a simple HTML sanitizer. It is commonly used to sanitize user-generated HTML input to prevent cross-site scripting (XSS) attacks. The package allows developers to specify a whitelist of allowed HTML tags and attributes, and it sanitizes the input by removing any disallowed tags or attributes. However, a vulnerability has been discovered in versions before 2.3.2 that allows attackers to bypass the hostname whitelist for iframe elements when the 'allowIframeRelativeUrls' option is set to true.
Vulnerability Detail
The vulnerability in sanitize-html arises from improper input validation of the hostnames set by the 'allowedIframeHostnames' option. When 'allowIframeRelativeUrls' is enabled, an attacker can bypass the hostname whitelist by using an src value that starts with '/\example.com'. This allows the attacker to inject malicious iframes from any hostname, potentially leading to XSS attacks or other security vulnerabilities.
How To Fix
Latest published version: 2.18.1 as of 23 Oct 2026
npm install sanitize-html@2.18.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.2
This is the first release that contains the fix.
npm install sanitize-html@2.3.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the 'allowIframeRelativeUrls' option. By setting this option to false, the vulnerability can be mitigated, but it may impact the functionality of the application if it relies on allowing relative URLs for iframes.
Conclusion
In conclusion, the sanitize-html package before version 2.3.2 is vulnerable to an improper input validation issue that allows attackers to bypass the hostname whitelist for iframes. Developers should upgrade to the latest version or apply the provided workaround to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sanitize-html →
FAQ
sanitize-html is an npm package used for sanitizing user-generated HTML input to prevent XSS attacks.
Versions of sanitize-html before 2.3.2 are affected by this vulnerability.
This vulnerability allows attackers to bypass the hostname whitelist for iframe elements, potentially leading to XSS attacks or other security vulnerabilities.
To fix this vulnerability, upgrade to sanitize-html version 2.3.2 or later.
Yes, a temporary workaround is to disable the 'allowIframeRelativeUrls' option.
Related vulnerabilities
Recent vulnerabilities recorded for sanitize-html.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
