CVE-2019-25225
published 2025-09-08CVE-2019-25225: `sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The `sanitizeHtml()` function in `index.js` does not sanitize content…
PriorityP426medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.25%
16.3th percentile
`sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The `sanitizeHtml()` function in `index.js` does not sanitize content when using the custom `transformTags` option, which is intended to convert attribute values into text. As a result, malicious input can be transformed into executable code.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apostrophecms | sanitize-html | < 2.0.0 | 2.0.0 |
| apostrophecms | sanitize-html | >= 0 < 2.0.0-beta | 2.0.0-beta |
| debian | node-sanitize-html | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
osv6.1MEDIUM
vendor_debian6.1LOW
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
sanitize-html: sanitize-html cross site scripting
vendor_redhat·2025-09-08·CVSS 6.1
CVE-2019-25225 [MEDIUM] CWE-79 sanitize-html: sanitize-html cross site scripting
sanitize-html: sanitize-html cross site scripting
`sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The `sanitizeHtml()` function in `index.js` does not sanitize content when using the custom `transformTags` option, which is intended to convert attribute values into text. As a result, malicious input can be transformed into executable code.
A cross site scripting vulnerability has been discovered in the npm sanitize-html library. The `sanitizeHtml()` function in `index.js` does not sanitize content when using the custom `transformTags` option, which is intended to convert attribute values into text. As a result, malicious input can be transformed into executable code.
Mitigation: Mitigation for this issue is either not available or the currently av
Debian
CVE-2019-25225: node-sanitize-html - `sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scriptin...
vendor_debian·2019·CVSS 6.1
CVE-2019-25225 [MEDIUM] CVE-2019-25225: node-sanitize-html - `sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scriptin...
`sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The `sanitizeHtml()` function in `index.js` does not sanitize content when using the custom `transformTags` option, which is intended to convert attribute values into text. As a result, malicious input can be transformed into executable code.
Scope: local
bookworm: resolved
forky: resolved
sid: resolved
trixie: resolved
OSV
sanitize-html is vulnerable to XSS through incomprehensive sanitization
osv·2025-09-08
CVE-2019-25225 [MEDIUM] sanitize-html is vulnerable to XSS through incomprehensive sanitization
sanitize-html is vulnerable to XSS through incomprehensive sanitization
`sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The `sanitizeHtml()` function in `index.js` does not sanitize content when using the custom `transformTags` option, which is intended to convert attribute values into text. As a result, malicious input can be transformed into executable code.
OSV
CVE-2019-25225: `sanitize-html` prior to version 2
osv·2025-09-08·CVSS 6.1
CVE-2019-25225 [MEDIUM] CVE-2019-25225: `sanitize-html` prior to version 2
`sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The `sanitizeHtml()` function in `index.js` does not sanitize content when using the custom `transformTags` option, which is intended to convert attribute values into text. As a result, malicious input can be transformed into executable code.
GHSA
sanitize-html is vulnerable to XSS through incomprehensive sanitization
ghsa·2025-09-08
CVE-2019-25225 [MEDIUM] CWE-79 sanitize-html is vulnerable to XSS through incomprehensive sanitization
sanitize-html is vulnerable to XSS through incomprehensive sanitization
`sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The `sanitizeHtml()` function in `index.js` does not sanitize content when using the custom `transformTags` option, which is intended to convert attribute values into text. As a result, malicious input can be transformed into executable code.
No detection rules found.
No public exploits indexed.
2025-09-08
Published