CVE-2026-84371

Name of the Vulnerable Software and Affected Versions sanitize-html versions 1.9.0 through 2.17.6

Description In configurations that allow animate, animateColor, animateMotion, animateTransform, or set elements, the packages/sanitize-html/index.js file fails to correctly validate the values attribute when the attributeName selects href or xlink:href. The sanitizer treats the values attribute as a single flat URL rather than recognizing SVG SMIL URL semantics, where values can be a list. An attacker can provide a list that begins with a safe fragment followed by an executable destination (such as javascript:). This allows the malicious destination to bypass the allowedSchemesAppliedToAttributes check. When the sanitized SVG is rendered and the link is activated, the browser may execute the script in the application's origin.

Recommendations Update sanitize-html to version 2.17.7. As a temporary workaround, restrict the use of the animate, animateColor, animateMotion, animateTransform, and set elements in the sanitizer configuration.