PT-2025-36452 · Unknown · Sanitize-Html

CVE-2019-25225

·

Published

2025-09-08

·

Updated

2026-06-04

CVSS v3.1

6.1

Medium

VectorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions: sanitize-html versions prior to 2.0.0-beta
Description: The sanitizeHtml() function in index.js does not sanitize content when using the custom transformTags option, which is intended to convert attribute values into text. This allows malicious input to be transformed into executable code.
Recommendations: Update to sanitize-html version 2.0.0-beta or later.

Exploit

Fix

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-25225
GHSA-QHXP-V273-G94H

Affected Products

Sanitize-Html