GHSA-cv27-6wvh-8x7j: XSS
Summary
CVE-2026-53606 expanded allowedSchemesAppliedToAttributes so named URL attributes (action, formaction, data, poster, background, later ping, xlink:href, …) go through naughtyHref(). A URL nested inside meta content (http-equiv=refresh) is not an attribute name on that list, so the embedded destination is never scheme-checked.
Default allowedTags still omit meta. Same non-default integrator config as 53606: allow meta plus http-equiv / content.
On 2.17.7:
text sanitizeHtml( '<meta http-equiv="refresh" content="0;url=javascript:alert(1)">', { allowedTags: ['meta'], allowedAttributes: { meta: ['http-equiv', 'content'] } } ) // => <meta http-equiv="refresh" content="0;url=javascript:alert(1)" />
data:text/html,… and arbitrary https: destinations also survive. formaction="javascript:…" (53606) is stripped.
Please Request CVE. Credit: Finder + Reporter (adrbogacz).
Details
naughtyHref() only runs when the attribute name is in allowedSchemesAppliedToAttributes (index.js ~385). Refresh URLs live in a content value of the form 0;url=…, so the gate never fires. Adding content to that list wholesale would break ordinary meta content (description, viewport).
Fix: when http-equiv is refresh (case-insensitive), parse the ; url= destination and run naughtyHref('meta', url). Drop content (or the tag) if the URL is rejected. Leave other meta content values alone.
PoC
Local sanitize-html@2.17.7. Output inspection only:
text node -e ' const sanitize = require("sanitize-html"); const opts = { allowedTags: ["meta"], allowedAttributes: { meta: ["http-equiv", "content"] } }; for (const html of [ "<meta http-equiv=\"refresh\" content=\"0;url=javascript:alert(1)\">", "<meta http-equiv=\"refresh\" content=\"0;url=data:text/html,aaa\">", "<form><button formaction=\"javascript:alert(1)\">x</button></form>", ]) { console.log(html, "=>", sanitize(html, html.includes("meta") ? opts : { allowedTags: ["form","button"], allowedAttributes: { button: ["formaction"] } })); } '
Expected: refresh javascript: / data: remain; 53606 formaction is removed. Do not attach a browser hang or stored-XSS page.
Impact
An integrator who allowed meta + content expecting allowedSchemes to apply (the 53606 configuration pattern) still emits a refresh to javascript:, data:, or an attacker https: URL. Stored XSS / open redirect for viewers of that HTML. Default config is not affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/sanitize-htmlto a version that resolves this vulnerability.Fixed in 2.18.0 - Compensating control
For sanitize-html meta elements, when http-equiv is refresh (case-insensitive), parse the ;url= destination from content and pass it to naughtyHref('meta', url). If the URL is rejected, drop the content or the meta tag, while leaving other meta content values unchanged.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments are exposed only if they have changed the sanitizer configuration to allow meta tags and permit the meta http-equiv and content attributes. The default allowedTags configuration omits meta.
What must an attacker be able to do to exploit it?
An attacker needs to supply HTML that is processed with the affected non-default configuration and later rendered by a browser. A meta refresh value such as content="0;url=javascript:..." can retain its embedded destination because the URL inside content is not scheme-checked.
What can be done if updating is not immediately possible?
Do not allow meta tags, or do not allow the http-equiv and content attributes on meta tags, where they are not required. In particular, prevent attacker-controlled meta http-equiv="refresh" elements from reaching rendered output.
How can I determine whether my configuration is affected?
Review whether allowedTags includes meta and allowedAttributes permits http-equiv and content for meta. On version 2.17.7, sanitizing a meta refresh element with content="0;url=javascript:alert(1)" under that configuration preserves the element and its content value.