CVE-2019-25225: XSS
sanitize-html prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The sanitizeHtml() function in index.js does not sanitize content when using the custom transformTags option, which is intended to convert attribute values into text. As a result, malicious input can be transformed into executable code.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-25225?
CVE-2019-25225 has a medium severity rating due to its potential for Cross-site Scripting (XSS) attacks.
How do I fix CVE-2019-25225?
To fix CVE-2019-25225, upgrade to sanitize-html version 2.0.0-beta or later.
What type of vulnerability is CVE-2019-25225?
CVE-2019-25225 is a Cross-site Scripting (XSS) vulnerability affecting sanitize-html.
Which versions of sanitize-html are affected by CVE-2019-25225?
CVE-2019-25225 affects sanitize-html versions prior to 2.0.0-beta.
What makes CVE-2019-25225 particularly dangerous?
CVE-2019-25225 is dangerous because it does not properly sanitize content when using the custom transformTags option, allowing execution of malicious scripts.