https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T13:42:04.091034+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2018-14553 cnvd-2018-14553 2026-10-15T13:42:04.094236+00:00 cnvd-2018-14553 https://cve.radiocsirt.org/vuln/euvd-2026-180394 EUVD-2026-180394 2026-10-15T13:42:04.094267+00:00 EUVD-2026-180394 https://cve.radiocsirt.org/vuln/fkie_cve-2017-16017 fkie_cve-2017-16017 2026-10-15T13:42:04.094282+00:00

sanitize-html is a library for scrubbing html input for malicious values Versions 1.2.2 and below have a cross site scripting vulnerability.

 https://cve.radiocsirt.org/vuln/ghsa-wg96-3933-j2w5 GHSA-wg96-3933-j2w5 — Cross-Site Scripting in sanitize-html 2026-10-15T13:42:04.094309+00:00

Affected: npm: sanitize-html

Affected versions of `sanitize-html` are vulnerable to cross-site scripting.

## Proof of Concept:

`<IMG SRC= onmouseover="alert('XSS');">` produces the following:

`<img src="onmouseover="alert('XSS');"" />` This is definitely invalid HTML, but would suggest that it's being interpreted incorrectly by the parser.

## Recommendation

Update to version 1.2.3 or later.

 https://cve.radiocsirt.org/vuln/gsd-2017-16017 gsd-2017-16017 2026-10-15T13:42:04.094337+00:00 gsd-2017-16017