CVE-2026-113661

Name of the Vulnerable Software and Affected Versions sanitize-html versions prior to 2.18.0

Description A non-default configuration that allows meta tags along with their http-equiv and content attributes fails to properly sanitize the content value when http-equiv is set to refresh. This occurs because the naughtyHref() function, which checks for unsafe URL schemes, is not applied to the content attribute of meta tags. Consequently, unsafe script execution via javascript: or data: URIs, as well as arbitrary https: redirect destinations, can be retained in the output. This can lead to stored cross-site scripting (XSS) or open redirects for users viewing the sanitized HTML.

Recommendations Update sanitize-html to version 2.18.0. As a temporary workaround, restrict the use of the meta tag or the content attribute in the sanitizer configuration to prevent the injection of refresh elements.