CVE-2026-53606

Name of the Vulnerable Software and Affected Versions sanitize-html versions prior to 2.17.5

Description The software uses the allowedSchemesAppliedToAttributes variable to control the naughtyHref() function, which is designed to block dangerous URI schemes such as javascript: and vbscript:. However, several attributes that accept URIs—including action, formaction, data, poster, background, ping, xlink:href, dynsrc, and lowsrc—are missing from the default gate list. If a developer enables any of these attributes in the configuration, javascript: URIs are not modified, leading to Cross-Site Scripting (XSS), a technique where malicious scripts are injected into trusted websites.

Recommendations Update to version 2.17.5.