en
Severity across 3 analyzed records
Verify to analyze this security profile
As of 09/14/2026, within CyStack's analyzed data, sanitize-html has 0 security vulnerabilities published in the last 90 days. Of these, 0 are rated High or Critical. None of these vulnerabilities is listed in the CISA KEV catalog. CyStack recommends that organizations and individual users remediate applicable vulnerabilities as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of sanitize-html and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-53606sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and background attributes | Exploitation statusPublic exploit | FixNot confirmed | Published06/12/2026 | SeverityMedium |
CVE-2026-44990Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` | Exploitation statusPublic exploit | FixNot confirmed | Published06/12/2026 | SeverityCritical |
CVE-2026-40186ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements | Exploitation statusPublic exploit | FixYes | Published04/15/2026 | SeverityMedium |
CVE-2014-125128 | Exploitation statusPublic exploit | FixYes | Published09/08/2025 | SeverityMedium |
CVE-2019-25225 | Exploitation statusPublic exploit | FixYes | Published09/08/2025 | SeverityMedium |
CVE-2024-21501 | Exploitation statusPublic exploit | FixYes | Published02/24/2024 | SeverityMedium |
CVE-2022-25887Regular Expression Denial of Service (ReDoS) | Exploitation statusNot confirmed | FixYes | Published08/30/2022 | SeverityMedium |
CVE-2021-26540 | Exploitation statusNot confirmed | FixNot confirmed | Published02/08/2021 | SeverityUnknown |
CVE-2021-26539 | Exploitation statusNot confirmed | FixNot confirmed | Published02/08/2021 | SeverityUnknown |
CVE-2016-1000237 | Exploitation statusNot confirmed | FixNot confirmed | Published01/23/2020 | SeverityUnknown |
