| Package | Affected versions | Patched versions |
|---|---|---|
| sanitize-html | < 2.0.0 | 2.0.0 |
| sanitize-html | < 2.0.0-beta | 2.0.0-beta |
sanitize-html prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The sanitizeHtml() function in index.js does not sanitize content when using the custom transformTags option, which is intended to convert attribute values into text. As a result, malicious input can be transformed into executable code.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free