StackPrism

npm package

sanitize-html vulnerabilities by version

The latest release, 2.18.1 (Oct 14, 2026), has no known vulnerabilities. 49% of last week’s 11.8M downloads went to versions with known vulnerabilities. OSV.dev lists 13 advisories for sanitize-html; the newest was published on Sep 3, 2026.

npm (opens in a new tab) describes it as “Clean up user-submitted HTML, preserving allowlisted elements and allowlisted attributes on a per-element basis”

Latest release
2.18.1
Oct 14, 2026, no known vulnerabilities
Downloads last week
11.8M
All versions, from npm
Advisories on OSV.dev
13
Newest Sep 3, 2026
Licence
MIT
OpenSSF Scorecard
6.3/10
apostrophecms/apostrophe (opens in a new tab)

Most-downloaded versions last week

From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.

VersionKnown vulnerabilitiesDownloads
2.17.7Aug 13, 2026No known vulnerabilities4.4M
2.18.0Sep 30, 2026No known vulnerabilities1.6M
2.17.5Jun 10, 20262 known vulnerabilities, worst rated warning1.1M
2.17.0May 14, 20253 known vulnerabilities, worst rated warning771.4K
2.17.4May 13, 20263 known vulnerabilities, worst rated warning752.7K
2.17.6Jul 10, 20261 known vulnerability, worst rated warning737.4K
2.7.0Feb 4, 20225 known vulnerabilities, worst rated critical470.5K
2.17.1Feb 18, 20263 known vulnerabilities, worst rated warning315.3K

Who is still on a vulnerable sanitize-html

49% of last week’s 11.8M sanitize-html downloads went to versions with known vulnerabilities.

From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.

Release lines

The newest release of each major line, from the registry. sanitize-html doesn’t publish support dates we can check.

LineNewest releaseReleased
22.18.1Oct 14, 2026
11.27.5Sep 23, 2020
0.10.1.4Sep 19, 2013

Newest advisories

The 5 most recently published, with the versions each one affects.

  1. WarningCVE-2026-63670 on OSV.dev (opens in a new tab)GHSA-jxwj-j7wr-gfrw

    ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close

    Affects < 2.17.6. Published Sep 3, 2026.

  2. WarningCVE-2026-84371 on OSV.dev (opens in a new tab)GHSA-g8qq-57p8-ggw5

    ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass

    Affects >= 1.9.0, < 2.17.7. Published Sep 1, 2026.

  3. WarningCVE-2026-53606 on OSV.dev (opens in a new tab)GHSA-vccv-cmxp-4j9h

    sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes

    Affects >= 1.18.0, < 2.17.5. Published Jul 31, 2026.

  4. CriticalCVE-2026-44990 on OSV.dev (opens in a new tab)GHSA-rpr9-rxv7-x643

    Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

    Affects >= 2.17.3, < 2.17.4. Published May 14, 2026.

  5. WarningCVE-2026-40186 on OSV.dev (opens in a new tab)GHSA-9mrh-v2v3-xpfm

    sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements

    Affects >= 2.17.2, < 2.17.3. Published Apr 16, 2026.

All 13 advisories are on OSV.dev (opens in a new tab).

Which sanitize-html do you have?

Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism reads every OSV.dev advisory for sanitize-html, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against OSV.dev, CISA KEV, npm and deps.dev.