CVE-2026-44990: Critical XSS Vulnerability in sanitize-html Package
Summary
CVE-2026-44990: Apostrophe has default XSS via xmp raw-text passthrough in sanitize-html. Affects sanitize-html versions < 2.17.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sanitize-html package is a widely used library in the Node.js ecosystem that allows developers to sanitize HTML content by removing potentially harmful tags and attributes. It is designed to help prevent cross-site scripting (XSS) attacks by ensuring that only safe HTML is rendered in web applications. However, a critical vulnerability has been identified in the default configuration of sanitize-html, specifically in version 2.17.3, which can lead to serious security risks if not addressed.
Vulnerability Detail
The vulnerability arises from a flaw in the handling of disallowed HTML tags, particularly the 'xmp' tag. Under the default configuration, sanitize-html does not treat the 'xmp' tag as a drop-the-contents tag, allowing attacker-controlled content within it to be processed as live HTML or JavaScript. This can lead to stored XSS vulnerabilities in applications that render sanitized output back to users. The issue is exacerbated by the fact that the README documentation does not accurately reflect the behavior of the sanitizer, leading to potential misuse by developers.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can avoid using the 'xmp' tag in their HTML content or ensure that any content passed to sanitize-html is thoroughly vetted and does not include potentially harmful tags. Additionally, consider using a custom configuration for sanitize-html that explicitly disallows the 'xmp' tag.
Conclusion
The CVE-2026-44990 vulnerability in the sanitize-html package poses a significant risk to applications that rely on its default configuration. It is crucial for developers to update to the latest version of the package and implement best practices for sanitizing HTML content to mitigate the risk of XSS attacks.
See every vulnerability recorded for sanitize-html →
FAQ
The CVSS score of this vulnerability is 9.3, indicating a critical level of risk.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability can allow attackers to execute arbitrary JavaScript in the context of another user's browser, leading to data theft, session hijacking, or other malicious activities.
Yes, updating to the latest version of sanitize-html will ensure that you are using a version that has addressed this vulnerability.
If an immediate update is not possible, consider implementing a workaround by avoiding the use of the 'xmp' tag and ensuring that any HTML content is properly sanitized before being rendered.
References
Related vulnerabilities
Recent vulnerabilities recorded for sanitize-html.
