Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

8 records

Vendor: apostrophecms Component: Sanitize-html Clear all filters
TI-2014-08427 CVE-2014-125128 · GHSA-389w-f784-rjg3

Cross-site scripting in sanitize-html

Priority MEDIUM 60

'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00274 Published 2025-09-08 Fixed in 1.0.3 CWE-79
TI-2019-15279 CVE-2019-25225 · GHSA-qhxp-v273-g94h

Cross-site scripting in sanitize-html

Priority MEDIUM 60

`sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00269 Published 2025-09-08 Fixed in 2.0.0-beta CWE-79
TI-2024-14258 CVE-2024-21501 · GHSA-rm97-x556-q36h

Information disclosure in sanitize-html

Priority MEDIUM 63

Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dep…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01027 Published 2024-02-24 Partial fix · 2.12.1 CWE-200
TI-2022-09444 CVE-2022-25887 · GHSA-cgfm-xwp7-2cvr

Regular expression denial of service (ReDoS) in sanitize-html

Priority LOW 36

The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01551 Published 2022-08-30 Partial fix · 2.7.1 CWE-1333
TI-2021-08273 CVE-2021-26540 · GHSA-mjxr-4v3x-q3m4

Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the…

Priority LOW 28

Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass h…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01775 Published 2021-02-08 Partial fix · 2.3.2 CWE-20
TI-2021-08272 CVE-2021-26539 · GHSA-rjqq-98f6-6j3r

Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle…

Priority LOW 28

Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" op…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01977 Published 2021-02-08 Partial fix · 2.3.1 CWE-20
TI-2016-09355 CVE-2016-1000237 · GHSA-3j7m-hmh3-9jmp

sanitize-html before 1.4.3 has XSS.

Priority LOW 29

sanitize-html before 1.4.3 has XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0084 Published 2020-01-23 Fixed in 1.4.3 CWE-79