Express XSS Sanitizer project

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

Express XSS Sanitizer project records in CISA KEV

No Express XSS Sanitizer project vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Express Xss Sanitizer 2 records HIGH

Records

2 records in Express Xss Sanitizer · all components

TI-2026-26320 CVE-2026-33979 · GHSA-3843-rr4g-m8jq

Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)

HIGH 75

Express XSS Sanitizer is Express 4.x and 5.x middleware which sanitizes user input data (in req.body, req.query, req.headers and req.params) to prevent Cross Site Scripting (XSS) attack.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00389 Published 2026-03-27 Fixed in 2.0.2 CWE-183

TI-2022-05570 CVE-2022-21169 · GHSA-grjp-4jmr-mjcw

Prototype pollution in express-xss-sanitizer

HIGH 65

The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00954 Published 2022-09-26 Fixed in 1.1.3 CWE-1321

Open these records in search →

Critical	0
High	2
Medium	1
Low	0
No CVSS	0