Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)
Date: 2026-03
Affected: npm/express-xss-sanitizer
Attack vector: xss
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-33979
CWE: CWE-183
CWE-79
CVSS: 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N)

## Description A vulnerability has been identified in express-xss-sanitizer (<= 2.0.1) where restrictive sanitization configurations are silently ignored. When a developer explicitly sets: allowedTags: [] allowedAttributes: {} the library incorrectly treats these values as "not provided" due to length/emptiness checks, and falls back to sanitize-html's default configuration. As a result, instead of stripping all HTML tags and attributes, the sanitizer allows a permissive set of tags ``` (e.g., <a>, <p>, <div>, etc.) and attributes (e.g., href on <a>)```. This behavior violates the expected API contract and may lead to security issues such as content injection or XSS, depending on how the sanitized output is used. ## Impact Developers intending to fully strip HTML content by providing empty allowedTags or allowedAttributes configurations may unknowingly allow a wide range of HTML elements and attributes. This can result in: - Injection of unintended HTML content ```(e.g., <div>, <table>, headings)``` - Injection of links via``` <a href="...">``` - Potential XSS vectors depending on downstream usage The impact depends on how the sanitized output is rendered or consumed, but the root issue is a mismatch between developer intent and actual behavior. ## Proof of Concept ```javascript const { sanitize } = require('express-xss-sanitizer'); const sanitizeHtml = require('sanitize-html'); const input = '<a href="http://evil.com">click</a><p>phish</p>'; // Using expres


Mitigations:

Architectural layers (MAESTRO):