npm sanitize-html

Name: npm sanitize-html
Brand: npm

productUS

pkg:npm/sanitize-html

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

public exploit

EPSS ≥ 10%

unpatched

critical

by severity

0critical1high6medium0low

updated 2026-10-28

vulnerabilities (17)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2021-26539US	medium5.3	1.95% (80th)	—	2.3.1	2021-02-08	< 2.3.1
CVE-2021-26540US	medium5.3	1.75% (78th)	—	2.3.2	2021-02-08	< 2.3.2
CVE-2022-25887US	high7.5	1.55% (75th)	—	2.7.1	2022-08-30	< 2.7.1
CVE-2017-16016US	medium6.1	1.34% (71st)	—	1.11.4	2018-06-04	< 1.11.4
CVE-2017-16017US	medium6.1	1.17% (67th)	—	1.2.3	2018-06-04	< 1.2.3
CVE-2024-21501US	medium5.3	1.03% (63rd)	—	2.12.1	2024-02-24	< 2.12.1
CVE-2016-1000237US	medium6.1	0.84% (58th)	—	1.4.3	2020-01-23	< 1.4.3
CVE-2026-44990US	—	0.68% (52nd)	—	2.17.4	2026-06-12	2.17.3 → 2.17.4
CVE-2026-113650US	—	0.40% (34th)	—	2.18.1	2026-10-20	2.18.0 → 2.18.1
CVE-2026-113654US	—	0.35% (28th)	—	2.18.0	2026-10-20	< 2.18.0
CVE-2026-63670US	—	0.33% (26th)	—	2.17.6	2026-08-17	< 2.17.6
CVE-2026-113657US	—	0.31% (24th)	—	2.18.0	2026-10-20	2.17.7 → 2.18.0
CVE-2026-84371US	—	0.30% (22nd)	—	2.17.7	2026-09-01	1.9.0 → 2.17.7
CVE-2019-25225US	—	0.27% (19th)	—	2.0.0-beta	2025-09-08	< 2.0.0-beta
CVE-2026-113661US	—	0.26% (18th)	—	2.18.0	2026-10-20	< 2.18.0
CVE-2026-40186US	—	0.25% (16th)	—	2.17.3	2026-04-15	2.17.2 → 2.17.3
CVE-2026-53606US	—	0.21% (11th)	—	2.17.5	2026-06-12	1.18.0 → 2.17.5

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')12 CVEs
CWE-20Improper Input Validation2 CVEs
CWE-1333Inefficient Regular Expression Complexity1 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor1 CVEs
CWE-538Insertion of Sensitive Information into Externally-Accessible File or Directory1 CVEs
CWE-674Uncontrolled Recursion1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.