StackPrism

npm package

sanitize-html 1.2.2 vulnerabilities

OSV.dev didn’t answer just now, so we can’t say whether sanitize-html 1.2.2 has known vulnerabilities. This page checks again within the hour.

npm (opens in a new tab) describes it as “Clean up user-submitted HTML, preserving allowlisted elements and allowlisted attributes on a per-element basis”

Known vulnerabilities
Not checked
OSV.dev didn’t answer
Released
Jul 17, 2014
Latest is 2.18.1
Downloads last week
15
Under 1% of sanitize-html downloads
Licence
MIT
OpenSSF Scorecard
4.1/10
punkave/sanitize-html (opens in a new tab)
Pulls in
11 packages
Resolved by deps.dev

What to upgrade to

2.18.1 is the closest release with no known vulnerabilities that we checked.

  • 1.27.5

    Newest 1.x release. Released Sep 23, 2020.

    8 known vulnerabilities, worst rated warning

  • 2.18.1Upgrade to this

    Latest release. Released Oct 14, 2026.

    No known vulnerabilities

2.18.1 came out on Oct 14, 2026. A coding agent trained before then doesn’t know it exists, so it may suggest an older release. AI knowledge cutoff dates

Findings

Who is still on a vulnerable sanitize-html

46% of last week’s 6.9M sanitize-html downloads went to versions with known vulnerabilities.

From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.

Is sanitize-html the only one?

Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism asks OSV.dev which advisories affect exactly sanitize-html 1.2.2, merges duplicates filed under several ids, and ranks them with CISA’s Known Exploited Vulnerabilities list and FIRST EPSS. Release dates and deprecation come from deps.dev and npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against npm, OSV.dev (didn’t answer) and deps.dev. Findings from that source may be missing; this page refreshes soon.