sanitize-html

Removed the dependency because sanitize-html used only a small part of its functionality, so security scanner reports for deepmerge no longer appear for sanitize-html users.

2.18.1release notes

Fallback markup remains sanitized but is limited to eight nested iframe elements; deeper fallback is escaped as text, and the current nesting depth carries into nested calls so nestingLimit applies to the whole output.

2.18.1release notes

Diagnostic messages are now single lines without decorative line breaks or a warning icon; their wording is unchanged.

2.18.0release notes

For allowed meta elements, refresh destinations in content are checked against allowedSchemes or allowedSchemesByTag.meta; rejected or unparseable refresh content is removed.

2.18.0release notes

Configurations allowing svg or math together with textarea or xmp no longer re-emit raw-text contents unescaped, preventing non-allowlisted markup from surviving sanitization.

2.17.6release notes

sanitize-html now requires Node.js >=22.12.0 because htmlparser2 is ESM-only from version 11 onward.

2.17.6release notes

More attributes are protected against unsafe URL types where those URLs are not appropriate.

2.17.5release notes

Markup preserved inside a disallowed iframe is no longer escaped and is fully sanitized according to the same rules as the original input.

2.18.0release notes

Animation elements and attributeName are matched by local name, ignoring prefixes, so namespace-prefixed elements such as svg:animate are recognized when dropping URL-retargeting animations.

2.18.0release notes

ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass

2.17.7security advisory

Fixed an XSS / URL scheme policy bypass when configurations allow SVG animation elements together with attributeName and an animation value attribute.

2.17.7release notes

ApostropheCMS: Mutation-XSS / allowedTags bypass via literal </textarea/> solidus close

2.17.6security advisory

Configurations allowing textarea or xmp are protected against trailing-solidus end tags causing following non-allowlisted markup to be re-emitted as raw text.

2.17.6release notes

Nonstandard nonTextTags configurations no longer let nested tags pass through without sanitization unless they are expressly allowed.

2.17.5release notes

sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes

2.17.5security advisory

Apostrophe has default XSS via xmp raw-text passthrough in sanitize-html

2.17.4security advisory

The xmp tag could pass forbidden markup through sanitize-html even when xmp was not explicitly allowed; users should update immediately.

2.17.4release notes

Fixes an XSS vulnerability that affected configurations explicitly permitting option tags.

2.17.3release notes

sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements

2.17.3security advisory

These references are now correctly decoded, preventing them from bypassing javascript: URL detection.

2.17.2release notes