express-xss-sanitizer vulnerable to Prototype Pollution via allowedTags attribute

MEDIUM 6.1CVE-2022-21169 · GHSA-grjp-4jmr-mjcw · Published 26/09/2022 · updated 17/06/2026

In short

CVE-2022-21169 is a MEDIUM (CVSS 6.1) vulnerability affecting express xss sanitizer (express xss sanitizer project), express-xss-sanitizer.
Chance of exploitation in the next 30 days (EPSS): 0.95%, higher than 61.5% of all vulnerabilities.
Fix: update to 1.1.3 or later.

Package	Affected versions	Patched versions
express xss sanitizer express_xss_sanitizer_project	`< 1.1.3`	`1.1.3`
express-xss-sanitizer npm	`< 1.1.3`	`1.1.3`

Description

The package express-xss-sanitizer before 1.1.3 is vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization.

NVD description

The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization.

References

nvd.nist.gov/vuln/detail/CVE-2022-21169 · ADVISORY
AhmedAdelFahim/express-xss-sanitizer · WEB
AhmedAdelFahim/express-xss-sanitizer commit 3bf8aaa · WEB
AhmedAdelFahim/express-xss-sanitizer · PACKAGE
runkit.com/embed/w306l6zfm7tu · WEB
security.snyk.io/vuln/SNYK-JS-EXPRESSXSSSANITIZER-3027443 · WEB

More vulnerabilities in express xss sanitizer

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

express xss sanitizer

express_xss_sanitizer_project

< 1.1.3

1.1.3

express-xss-sanitizer

npm

< 1.1.3

1.1.3

Description

The package express-xss-sanitizer before 1.1.3 is vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization.

NVD description

The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization.