sanitize-html
4 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2014-125128 | < 1.0.3 | 'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS). The function 'naughtyHref' doesn't properly validate the | MEDIUM 6.1 | 0.3 % | ||
| CVE-2019-25225 | < 2.0.0-beta | `sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The `sanitizeHtml()` function in `index.js` does no | MEDIUM 6.1 | 0.3 % | ||
| CVE-2024-21501 | < 2.12.1 | Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attri | MEDIUM 5.3 | 1.0 % | ||
| CVE-2022-25887 | unspecified – < 2.7.1 | Regular Expression Denial of Service (ReDoS) | HIGH 7.5 | 1.6 % |