CVE-2016-1000237: Cross-Site Scripting in sanitize-html
Summary
CVE-2016-1000237: Cross-Site Scripting in sanitize-html. Affects sanitize-html versions < 1.4.3. Fixed in 1.4.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sanitize-html package is an npm package used for sanitizing HTML input. It is designed to prevent cross-site scripting (XSS) attacks by removing potentially malicious code from user-generated HTML. However, certain versions of the package are vulnerable to a cross-site scripting vulnerability.
Vulnerability Detail
The vulnerability in affected versions of sanitize-html stems from the package's failure to sanitize input recursively. This allows an attacker to inject and execute arbitrary JavaScript code. If exploited, this vulnerability can lead to unauthorized access, data theft, and other malicious activities.
How To Fix
Latest published version: 2.18.1 as of 23 Oct 2026
npm install sanitize-html@2.18.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.3
This is the first release that contains the fix.
npm install sanitize-html@1.4.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Updating to the latest version is the recommended solution.
Conclusion
The sanitize-html package is vulnerable to a cross-site scripting (XSS) vulnerability that allows for the execution of arbitrary JavaScript code. To mitigate this vulnerability, it is essential to update to version 1.4.3 or later. Vulert Playground can be used to check if your application is affected by this vulnerability. For additional support, contact DevNack.com.
See every vulnerability recorded for sanitize-html →
FAQ
This vulnerability allows an attacker to execute arbitrary JavaScript code, potentially leading to unauthorized access, data theft, and other malicious activities.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
The CVSS score of this vulnerability is 6.1, indicating a moderate severity.
There may be known exploits for this vulnerability. It is crucial to update to the latest version of sanitize-html to mitigate the risk of exploitation.
For further support on vulnerability remediation, you can reach out to info@devnack.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for sanitize-html.
