CVE-2026-40186: sanitize-html Package Allows Bypass of allowedTags via Entity-Decoded Text
Summary
CVE-2026-40186: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements. Affects sanitize-html versions >= 2.17.2, < 2.17.3. Fixed in 2.17.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
sanitize-html is an npm package that sanitizes HTML input to prevent XSS attacks by allowing only specified tags and attributes. It is commonly used in web applications to ensure that user-generated content is safe for rendering. The package provides a configuration option called allowedTags, which defines which HTML tags are permitted. However, a recent vulnerability has been identified that allows attackers to bypass this restriction under certain conditions.
Vulnerability Detail
The vulnerability arises from a regression introduced in commit 49d0bb7, which incorrectly handles entity-encoded HTML within nonTextTagsArray elements, specifically <textarea> and <option>. When entity-encoded HTML is processed, it is decoded before being passed to the sanitizer, allowing arbitrary HTML tags to be injected, including potentially harmful scripts. This leads to a complete bypass of the allowedTags filter, posing a significant risk of stored XSS attacks, where an attacker can inject malicious scripts that execute in the context of the user's session.
How To Fix
Latest published version: 2.18.1 as of 23 Oct 2026
npm install sanitize-html@2.18.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.17.3
This is the first release that contains the fix.
npm install sanitize-html@2.17.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot immediately update the package, you can implement a temporary workaround by avoiding the use of <option> and <textarea> tags in your allowedTags configuration. This will prevent the vulnerability from being exploited until you can apply the patch.
Conclusion
The CVE-2026-40186 vulnerability in the sanitize-html package poses a significant risk by allowing the injection of arbitrary HTML tags through entity-decoded text in <textarea> and <option> elements. It is crucial to update to the patched version to protect your application from potential XSS attacks.
See every vulnerability recorded for sanitize-html →
FAQ
CVE-2026-40186 is a vulnerability in the sanitize-html package that allows attackers to bypass allowedTags restrictions through entity-decoded text in <textarea> and <option> elements.
If your application uses sanitize-html with <option> or <textarea> in its allowedTags configuration, it may be vulnerable to XSS attacks, allowing attackers to inject malicious scripts.
You should update sanitize-html to version 2.17.3 or later to mitigate the vulnerability. Use the command 'npm install sanitize-html@2.17.3' to update.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just package-lock.json. You can check your application at Vulert Scanner without signing up.
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for sanitize-html.
