npm/sanitize-html CVE-2019-25225: medium 6.1, EPSS 0.27%

sanitize-html is vulnerable to XSS through incomprehensive sanitization

Action: Upgrade sanitize-html to 2.0.0-beta or later.

npm i sanitize-html@2.0.0-beta

Affected

Fixed versions

Sources

• osv: GHSA-qhxp-v273-g94h
• https://nvd.nist.gov/vuln/detail/CVE-2019-25225
• https://github.com/apostrophecms/sanitize-html/issues/293
• https://github.com/apostrophecms/sanitize-html/pull/156
• https://github.com/apostrophecms/sanitize-html/commit/712cb6895825c8bb6ede71a16b42bade42abcaf3
• https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2019/CVE-2019-25225
• https://github.com/apostrophecms/sanitize-html

CVE-2019-25225 · published 2025-09-08T12:30:33Z · modified 2025-09-12T20:27:20.408277Z · JSON