PT-2025-36452 · Unknown · Sanitize-Html

Published 2025-09-08 · Updated 2025-12-23 · CVE-2019-25225

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: sanitize-html versions prior to 2.0.0-beta

Description: The sanitizeHtml() function in index.js does not sanitize content when using the custom transformTags option, which is intended to convert attribute values into text. This allows malicious input to be transformed into executable code.

Recommendations: Update to sanitize-html version 2.0.0-beta or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-25225

GHSA-QHXP-V273-G94H

Affected Products

Sanitize-Html

References · 13

• 🔥 https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2019/CVE-2019-25225 · Exploit
• https://github.com/apostrophecms/sanitize-html/commit/712cb6895825c8bb6ede71a16b42bade42abcaf3 · Patch
• https://github.com/apostrophecms/sanitize-html/issues/293 · Vendor Advisory
• https://github.com/apostrophecms/sanitize-html/pull/156 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-25225 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-25225 · Security Note
• https://osv.dev/vulnerability/GHSA-qhxp-v273-g94h · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2019-25225 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-25225 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-25225 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-25225 · Security Note
• https://github.com/apostrophecms/sanitize-html · Note
• https://t.me/CVEtracker/31945 · Telegram Post