CVE-2017-16017 — sanitize-html is a library for scrubbing html input for malicious values Versions 1.2.2 and below have a cross site scripting vulnerability

MEDIUM

sanitize-html is a library for scrubbing html input for malicious values Versions 1.2.2 and below have a cross site scripting vulnerability

Published Jun 4, 2018

6.1

MEDIUM

CVSS 3.0

EPSS 1.19%

sanitize-html is a library for scrubbing html input for malicious values Versions 1.2.2 and below have a cross site scripting vulnerability.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
<=1.2.2	affected	-

Ecosystem	Package	Introduced	Fixed
npm	sanitize-html	0	1.2.3

No remediation recorded yet.

1.19% 0.01185

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.01185

2021–2026

Table of values (9 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	1.19% (0.01185)	66.70th	v5 (v2026.06.15)
Sep 20, 2026	1.19% (0.01185)	66.43th	v5 (v2026.06.15)
Jul 20, 2024	0.12% (0.00119)	46.65th	v3 (v2023.03.01)
Jan 18, 2024	0.12% (0.00119)	45.99th	v3 (v2023.03.01)
Mar 7, 2023	0.12% (0.00117)	43.93th	v3 (v2023.03.01)
Mar 6, 2023	0.95% (0.00954)	36.37th	v2 (v2022.01.01)
Feb 4, 2022	0.95% (0.00954)	16.28th	v2 (v2022.01.01)
Feb 3, 2022	0.83% (0.00833)	24.58th	v5 (v2026.06.15)
Apr 14, 2021	0.83% (0.00833)	0.00th	v1

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

Link	Providers	Tags
https://github.com/advisories/GHSA-wg96-3933-j2w5		Advisory
https://github.com/punkave/sanitize-html/issues/19		x_refsource_MISCExploitThird Party Advisory
https://github.com/punkave/sanitize-html/pull/20		x_refsource_MISCIssue Tracking
https://nodesecurity.io/advisories/155		x_refsource_MISCExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2017-16017
https://www.npmjs.com/advisories/155