CVE-2019-25225 – Sanitize-html Cross-site Scripting (XSS)

CVE ID : CVE-2019-25225

Published : Sept. 8, 2025, 10:15 a.m. | 37 minutes ago

Description : `sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The `sanitizeHtml()` function in `index.js` does not sanitize content when using the custom `transformTags` option, which is intended to convert attribute values into text. As a result, malicious input can be transformed into executable code.

Severity: 6.1 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…