CVE-2026-53606: sanitize-html Incomplete URI Scheme Validation Leading to XSS Vulnerability
Summary
CVE-2026-53606: sanitize-html uses allowedSchemesAppliedToAttributes (default: ['href', 'src', 'cite']) to gate the naughtyHref() function that blocks dangerous URI schemes like javascript: and vbscript:. Affects sanitize-html versions >= 1.18.0, < 2.17.5. Fixed in 2.17.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
sanitize-html is a popular npm package used to sanitize HTML input, allowing developers to safely render user-generated content in web applications. It provides a configurable way to specify which HTML tags and attributes are allowed, ensuring that potentially harmful scripts are removed. However, the package has a vulnerability that allows certain URI schemes, specifically 'javascript:', to bypass its sanitization checks when specific attributes are permitted.
Vulnerability Detail
The vulnerability arises from the incomplete validation of URI schemes in the sanitize-html package. The function responsible for blocking dangerous URI schemes, 'naughtyHref()', is gated by a list of allowed attributes that does not include several URI-bearing attributes such as 'action', 'formaction', 'data', 'poster', and 'background'. This oversight allows attackers to inject malicious JavaScript code through these attributes, leading to Cross-Site Scripting (XSS) attacks. The default configuration is not vulnerable, but many developers may inadvertently expose their applications by allowing these attributes in their configurations.
How To Fix
Latest published version: 2.18.1 as of 23 Oct 2026
npm install sanitize-html@2.18.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.17.5
This is the first release that contains the fix.
npm install sanitize-html@2.17.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, a temporary workaround is to manually add the vulnerable attributes to the 'allowedSchemesAppliedToAttributes' list in your configuration. For example:
const sanitize = require('sanitize-html');
const cleanHtml = sanitize(userInput, {
allowedTags: ['form', 'button'],
allowedAttributes: { form: ['action'], button: ['formaction'] },
allowedSchemesAppliedToAttributes: ['href', 'src', 'cite', 'action', 'formaction', 'data', 'poster', 'background']
});
Conclusion
The sanitize-html package has a vulnerability that allows certain URI schemes to bypass sanitization checks, leading to potential XSS attacks. Developers should update to the patched version and consider adjusting their configuration to mitigate this risk. Using tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for sanitize-html →
FAQ
CVE-2026-53606 is a vulnerability in the sanitize-html package that allows JavaScript URIs to bypass sanitization checks, potentially leading to XSS attacks.
If your application uses sanitize-html versions between 1.18.0 and 2.17.4 and allows URI-bearing attributes like 'action' or 'formaction', it may be vulnerable.
The CVSS score for this vulnerability is 5.4, indicating a moderate severity level.
You can update sanitize-html to version 2.17.5 or later by running the command 'npm install sanitize-html@2.17.5' in your project directory.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in your software using just the package-lock.json file. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for sanitize-html.
