https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T11:03:43.892841+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-252159 EUVD-2026-252159 2026-10-02T11:03:43.969223+00:00 EUVD-2026-252159 https://cve.radiocsirt.org/vuln/fkie_cve-2019-25225 fkie_cve-2019-25225 2026-10-02T11:03:43.969260+00:00

`sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The `sanitizeHtml()` function in `index.js` does not sanitize content when using the custom `transformTags` option, which is intended to convert attribute values into text. As a result, malicious input can be transformed into executable code.

 https://cve.radiocsirt.org/vuln/ghsa-qhxp-v273-g94h GHSA-qhxp-v273-g94h — sanitize-html is vulnerable to XSS through incomprehensive sanitization 2026-10-02T11:03:43.969294+00:00

Affected: npm: sanitize-html

`sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The `sanitizeHtml()` function in `index.js` does not sanitize content when using the custom `transformTags` option, which is intended to convert attribute values into text. As a result, malicious input can be transformed into executable code.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2019-25225 UBUNTU-CVE-2019-25225 2026-10-02T11:03:43.969320+00:00

Affected: Ubuntu:22.04:LTS: node-sanitize-html, Ubuntu:24.04:LTS: node-sanitize-html, Ubuntu:25.10: node-sanitize-html, Ubuntu:26.04:LTS: node-sanitize-html

`sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The `sanitizeHtml()` function in `index.js` does not sanitize content when using the custom `transformTags` option, which is intended to convert attribute values into text. As a result, malicious input can be transformed into executable code.