Affected versions of sanitize-html are vulnerable to cross-site scripting.
Proof of Concept:
<IMG SRC= onmouseover="alert('XSS');"> produces the following:
<img src="onmouseover="alert('XSS');"" /> This is definitely invalid HTML, but would suggest that it's being interpreted incorrectly by the parser.
Recommendation
Update to version 1.2.3 or later.