CVE-2026-53606: sanitize-html XSS via Ungated URI Attributes—Patch to 2.17.5

Technical summary

sanitize-html's URI scheme validation uses the `allowedSchemesAppliedToAttributes` configuration to gate the `naughtyHref()` blocking function. The default gate list includes only `['href', 'src', 'cite']`, but the HTML specification defines over 10 URI-accepting attributes, including `action`, `formaction`, `data`, `poster`, `background`, `ping`, `xlink:href`, `dynsrc`, and `lowsrc`. When developers allow any of these ungated attributes in their sanitizer config, malicious `javascript:` and `vbscript:` URIs bypass scheme validation entirely and pass through to the rendered HTML. An attacker can then trigger these URIs via user interaction (click, form submission, image load) to execute arbitrary JavaScript in the victim's security context. This is a logic-level vulnerability: the sanitizer doesn't crash or reject input; it silently permits dangerous content.

Business impact

If your application uses sanitize-html to render user-supplied or third-party HTML (comments, rich text editors, email content, etc.), and your configuration permits any of the ungated URI attributes, attackers can inject persistent or reflected XSS. This could lead to account compromise, credential theft, malware distribution, defacement, or unauthorized actions on behalf of legitimate users. The CVSS score of 5.4 reflects that exploitation requires user interaction and authenticated access, but the scope is changed (impact crosses trust boundaries), making it a material risk for multi-user or customer-facing systems.

Affected systems

Any application using sanitize-html versions prior to 2.17.5 is potentially affected if: (1) the developer's configuration explicitly allows HTML attributes beyond the default set (`href`, `src`, `cite`), and (2) at least one of those attributes is a URI-accepting field (`action`, `formaction`, `data`, `poster`, `background`, `ping`, `xlink:href`, `dynsrc`, `lowsrc`). Applications using only default settings and attributes are not vulnerable to this specific issue. ApostropheCMS and other Node.js projects that depend on sanitize-html with permissive configurations are at risk.

Exploitability

Exploitability is moderate. An attacker must craft malicious HTML that includes a dangerous URI in one of the ungated attributes. The victim must then interact with the rendered content (click a link, submit a form, or trigger an image load, depending on the attribute). The attack vector is network-based and requires low privilege (user authentication to submit content), but the attacker must convince a user to interact with the payload—there is no automatic execution. Given that many web applications allow HTML input from authenticated users or trust certain third parties, this is a practical vulnerability in real-world deployments.

Remediation

Upgrade sanitize-html to version 2.17.5 or later immediately. After patching, verify that your application's HTML sanitizer configuration is still correct and audit any user-supplied HTML that may have been stored during the vulnerable window. Consider implementing additional mitigations: (1) use a Content Security Policy to restrict `script-src` and other directives, limiting the impact of any injected JavaScript, and (2) review and minimize the set of allowed HTML attributes—only permit what your use case genuinely requires.

Patch guidance

Update your npm dependencies by running `npm update sanitize-html` or by manually updating your package.json to version 2.17.5 and reinstalling. If you use a lock file (package-lock.json or yarn.lock), regenerate it after the upgrade. Test your HTML sanitization logic to ensure that legitimate content still renders correctly and that no regressions are introduced. If you have custom configurations that explicitly allow URI-accepting attributes, verify that the patched version's new scheme-checking behavior does not break your intended functionality.

Detection guidance

Search your codebase for instances where sanitize-html is instantiated with custom `allowList` or `allowedAttributes` configurations that include `action`, `formaction`, `data`, `poster`, `background`, `ping`, `xlink:href`, `dynsrc`, or `lowsrc`. Check application logs and content repositories for HTML payloads containing `javascript:`, `vbscript:`, or other dangerous URI schemes in these attributes, which may indicate exploitation attempts or successful injections during the vulnerable period. Monitor for unexpected script execution or user-reported account activity anomalies in systems that accept rich HTML input.

Why prioritize this

Although the CVSS score is 5.4 (Medium), this vulnerability should be prioritized based on your exposure: if your application renders user-supplied HTML with any of the ungated attributes enabled, patch immediately. The attack requires user interaction but can lead to account takeover or privilege escalation in multi-user systems. If your sanitizer configuration uses only default attributes (`href`, `src`, `cite`), risk is lower, but you should still upgrade as a preventive measure and to reduce your attack surface.

Risk score, explained

The CVSS 3.1 score of 5.4 reflects Attack Vector: Network, Attack Complexity: Low, Privileges Required: Low (user must be authenticated to submit content), User Interaction: Required (victim must interact with malicious HTML), and Scope: Changed (impact crosses from the attacker's privilege level to the victim's). Integrity and Confidentiality are impacted (XSS can steal data or modify content), but Availability is not. The score is kept in the Medium range because authentication and user interaction are prerequisites; however, in practice, the risk may be higher if your application permits broad HTML input or trusts certain third-party content.

Frequently asked questions