HtmlSanitizer
Cleans HTML to avoid XSS attacks
Activity
- Latest release
- 22h ago
- Total releases
- 64
- Cadence
- ~2 days
- Last 12 months
- 11
Reach
- Stars
- 1.7k
Details
- License
- MIT
- First release
- Dec 23, 2020
| Version | Released | |
|---|---|---|
9.1.974
patch
| ||
9.1.973
minor
| ||
9.1.968-beta
pre
| ||
9.0.967
patch
| ||
9.1.966-beta
pre
| ||
9.1.949-beta
pre
| ||
9.1.923-beta
pre
| ||
9.1.893-beta
pre
| ||
9.0.892
patch
| ||
9.1.891-beta
pre
1 CVE
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev | ||
9.0.889
patch
1 CVE
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev | ||
9.1.887-beta
pre
1 CVE
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev | ||
9.0.886
patch
1 CVE
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev | ||
9.1.885-beta
pre
1 CVE
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev | ||
9.0.884
patch
1 CVE
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev | ||
9.1.882-beta
pre
1 CVE
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev | ||
9.0.881
patch
1 CVE
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev | ||
9.1.878-beta
pre
1 CVE
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev | ||
9.0.876
patch
1 CVE
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev | ||
9.0.873
major
1 CVE
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev | ||
8.2.871-beta
pre
1 CVE
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev | ||
8.1.870
minor
1 CVE
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev | ||
8.1.866-beta
pre
1 CVE
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev | ||
8.0.865
patch
1 CVE
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev | ||
8.1.860-beta
pre
1 CVE
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev | ||
8.1.844-beta
pre
1 CVE
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev | ||
8.0.843
patch
1 CVE
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev | ||
8.1.839-beta
pre
1 CVE
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev | ||
8.0.838
patch
1 CVE
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev | ||
8.1.812-beta
pre
1 CVE
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev | ||
8.0.811
patch
1 CVE
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev | ||
8.1.796-beta
pre
1 CVE
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev | ||
8.0.795
patch
1 CVE
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev | ||
8.1.748-beta
pre
1 CVE
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev | ||
8.1.747-beta
pre
1 CVE
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev | ||
8.0.746
patch
1 CVE
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev | ||
8.1.745-beta
pre
1 CVE
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev | ||
8.0.744
patch
1 CVE
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev | ||
8.0.723
patch
1 CVE
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev | ||
8.1.722-beta
pre
1 CVE
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev | ||
8.1.719-beta
pre
2 CVEs
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev
CVE-2023-44390
GHSA-43cp-6p3q-2pc4
Oct 04, 2023
HtmlSanitizer vulnerable to Cross-site Scripting in Foreign Content
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
ImpactThe vulnerability occurs in configurations where foreign content is allowed, i.e. either
Configurations that meet the above requirements plus the following are vulnerable to an additional vulnerability:
In case an application sanitizes user input with a vulnerable configuration, an attacker could bypass the sanitization and inject arbitrary HTML, including JavaScript code. Note that in the default configuration the vulnerability is not present. PatchesThe vulnerability has been fixed in versions 8.0.723 and 8.1.722-beta (preview version). WorkaroundsDisallow foreign elements Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 85 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.1.717-beta
8.1.719-beta
Fixed in
8.0.723
8.1.722-beta
References Updated Feb 16, 2024 · Source: OSV.dev | ||
8.0.718
patch
2 CVEs
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev
CVE-2023-44390
GHSA-43cp-6p3q-2pc4
Oct 04, 2023
HtmlSanitizer vulnerable to Cross-site Scripting in Foreign Content
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
ImpactThe vulnerability occurs in configurations where foreign content is allowed, i.e. either
Configurations that meet the above requirements plus the following are vulnerable to an additional vulnerability:
In case an application sanitizes user input with a vulnerable configuration, an attacker could bypass the sanitization and inject arbitrary HTML, including JavaScript code. Note that in the default configuration the vulnerability is not present. PatchesThe vulnerability has been fixed in versions 8.0.723 and 8.1.722-beta (preview version). WorkaroundsDisallow foreign elements Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 85 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.1.717-beta
8.1.719-beta
Fixed in
8.0.723
8.1.722-beta
References Updated Feb 16, 2024 · Source: OSV.dev | ||
8.1.717-beta
pre
2 CVEs
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev
CVE-2023-44390
GHSA-43cp-6p3q-2pc4
Oct 04, 2023
HtmlSanitizer vulnerable to Cross-site Scripting in Foreign Content
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
ImpactThe vulnerability occurs in configurations where foreign content is allowed, i.e. either
Configurations that meet the above requirements plus the following are vulnerable to an additional vulnerability:
In case an application sanitizes user input with a vulnerable configuration, an attacker could bypass the sanitization and inject arbitrary HTML, including JavaScript code. Note that in the default configuration the vulnerability is not present. PatchesThe vulnerability has been fixed in versions 8.0.723 and 8.1.722-beta (preview version). WorkaroundsDisallow foreign elements Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 85 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.1.717-beta
8.1.719-beta
Fixed in
8.0.723
8.1.722-beta
References Updated Feb 16, 2024 · Source: OSV.dev | ||
8.0.692
patch
2 CVEs
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev
CVE-2023-44390
GHSA-43cp-6p3q-2pc4
Oct 04, 2023
HtmlSanitizer vulnerable to Cross-site Scripting in Foreign Content
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
ImpactThe vulnerability occurs in configurations where foreign content is allowed, i.e. either
Configurations that meet the above requirements plus the following are vulnerable to an additional vulnerability:
In case an application sanitizes user input with a vulnerable configuration, an attacker could bypass the sanitization and inject arbitrary HTML, including JavaScript code. Note that in the default configuration the vulnerability is not present. PatchesThe vulnerability has been fixed in versions 8.0.723 and 8.1.722-beta (preview version). WorkaroundsDisallow foreign elements Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 85 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.1.717-beta
8.1.719-beta
Fixed in
8.0.723
8.1.722-beta
References Updated Feb 16, 2024 · Source: OSV.dev | ||
8.0.691-beta
pre
2 CVEs
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev
CVE-2023-44390
GHSA-43cp-6p3q-2pc4
Oct 04, 2023
HtmlSanitizer vulnerable to Cross-site Scripting in Foreign Content
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
ImpactThe vulnerability occurs in configurations where foreign content is allowed, i.e. either
Configurations that meet the above requirements plus the following are vulnerable to an additional vulnerability:
In case an application sanitizes user input with a vulnerable configuration, an attacker could bypass the sanitization and inject arbitrary HTML, including JavaScript code. Note that in the default configuration the vulnerability is not present. PatchesThe vulnerability has been fixed in versions 8.0.723 and 8.1.722-beta (preview version). WorkaroundsDisallow foreign elements Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 85 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.1.717-beta
8.1.719-beta
Fixed in
8.0.723
8.1.722-beta
References Updated Feb 16, 2024 · Source: OSV.dev | ||
8.0.690-beta
pre
2 CVEs
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev
CVE-2023-44390
GHSA-43cp-6p3q-2pc4
Oct 04, 2023
HtmlSanitizer vulnerable to Cross-site Scripting in Foreign Content
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
ImpactThe vulnerability occurs in configurations where foreign content is allowed, i.e. either
Configurations that meet the above requirements plus the following are vulnerable to an additional vulnerability:
In case an application sanitizes user input with a vulnerable configuration, an attacker could bypass the sanitization and inject arbitrary HTML, including JavaScript code. Note that in the default configuration the vulnerability is not present. PatchesThe vulnerability has been fixed in versions 8.0.723 and 8.1.722-beta (preview version). WorkaroundsDisallow foreign elements Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 85 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.1.717-beta
8.1.719-beta
Fixed in
8.0.723
8.1.722-beta
References Updated Feb 16, 2024 · Source: OSV.dev | ||
8.0.645
patch
2 CVEs
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev
CVE-2023-44390
GHSA-43cp-6p3q-2pc4
Oct 04, 2023
HtmlSanitizer vulnerable to Cross-site Scripting in Foreign Content
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
ImpactThe vulnerability occurs in configurations where foreign content is allowed, i.e. either
Configurations that meet the above requirements plus the following are vulnerable to an additional vulnerability:
In case an application sanitizes user input with a vulnerable configuration, an attacker could bypass the sanitization and inject arbitrary HTML, including JavaScript code. Note that in the default configuration the vulnerability is not present. PatchesThe vulnerability has been fixed in versions 8.0.723 and 8.1.722-beta (preview version). WorkaroundsDisallow foreign elements Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 85 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.1.717-beta
8.1.719-beta
Fixed in
8.0.723
8.1.722-beta
References Updated Feb 16, 2024 · Source: OSV.dev | ||
8.0.601
major
2 CVEs
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev
CVE-2023-44390
GHSA-43cp-6p3q-2pc4
Oct 04, 2023
HtmlSanitizer vulnerable to Cross-site Scripting in Foreign Content
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
ImpactThe vulnerability occurs in configurations where foreign content is allowed, i.e. either
Configurations that meet the above requirements plus the following are vulnerable to an additional vulnerability:
In case an application sanitizes user input with a vulnerable configuration, an attacker could bypass the sanitization and inject arbitrary HTML, including JavaScript code. Note that in the default configuration the vulnerability is not present. PatchesThe vulnerability has been fixed in versions 8.0.723 and 8.1.722-beta (preview version). WorkaroundsDisallow foreign elements Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 85 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.1.717-beta
8.1.719-beta
Fixed in
8.0.723
8.1.722-beta
References Updated Feb 16, 2024 · Source: OSV.dev | ||
7.1.542
patch
2 CVEs
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev
CVE-2023-44390
GHSA-43cp-6p3q-2pc4
Oct 04, 2023
HtmlSanitizer vulnerable to Cross-site Scripting in Foreign Content
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
ImpactThe vulnerability occurs in configurations where foreign content is allowed, i.e. either
Configurations that meet the above requirements plus the following are vulnerable to an additional vulnerability:
In case an application sanitizes user input with a vulnerable configuration, an attacker could bypass the sanitization and inject arbitrary HTML, including JavaScript code. Note that in the default configuration the vulnerability is not present. PatchesThe vulnerability has been fixed in versions 8.0.723 and 8.1.722-beta (preview version). WorkaroundsDisallow foreign elements Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 85 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.1.717-beta
8.1.719-beta
Fixed in
8.0.723
8.1.722-beta
References Updated Feb 16, 2024 · Source: OSV.dev | ||
7.1.512
patch
2 CVEs
CVE-2026-25543
GHSA-j92c-7v7g-gj3f
Feb 03, 2026
HtmlSanitizer has a bypass via template tag
Medium
Network
Low
None
None
ImpactIf the The lack of sanitization of the template tag brings up two bypasses:
Note that the default configuration is not affected because the PatchesThe problem has been patched in versions 9.0.892 and 9.1.893-beta. WorkaroundsDisallow the Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 108 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.0.723
8.0.744
8.0.746
8.0.795
8.0.811
8.0.838
8.0.843
8.0.865
8.1.717-beta
8.1.719-beta
8.1.722-beta
8.1.745-beta
8.1.747-beta
8.1.748-beta
8.1.796-beta
8.1.812-beta
8.1.839-beta
8.1.844-beta
8.1.870
9.0.873
9.0.876
9.0.881
9.0.884
9.0.886
9.0.889
Fixed in
9.0.892
9.1.893-beta
References
Updated Feb 28, 2026 · Source: OSV.dev
CVE-2023-44390
GHSA-43cp-6p3q-2pc4
Oct 04, 2023
HtmlSanitizer vulnerable to Cross-site Scripting in Foreign Content
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
ImpactThe vulnerability occurs in configurations where foreign content is allowed, i.e. either
Configurations that meet the above requirements plus the following are vulnerable to an additional vulnerability:
In case an application sanitizes user input with a vulnerable configuration, an attacker could bypass the sanitization and inject arbitrary HTML, including JavaScript code. Note that in the default configuration the vulnerability is not present. PatchesThe vulnerability has been fixed in versions 8.0.723 and 8.1.722-beta (preview version). WorkaroundsDisallow foreign elements Affected versions
1.0.4925.29815
1.0.4927.30873
1.1.5243.28448
1.1.5297.28403
1.1.5338.17998
2.0.5449.20550
2.0.5548.24932
2.0.5595.22183
2.0.5595.30325
2.0.5623.30465
2.0.5735.24296
3.0.5781.31354-beta
+ 85 more Show less
3.0.66-beta
3.1.67-beta
3.1.75-beta
3.1.76
3.1.79
3.1.91
3.1.93
3.1.98
3.2.100-beta
3.2.103
3.2.105
3.2.96-beta
3.3.122-beta
3.3.125-beta
3.3.126-beta
3.3.127-beta
3.3.128-beta
3.3.129-beta
3.3.130-beta
3.3.131-beta
3.3.132-beta
3.3.142
3.3.143-beta
3.3.144-beta
3.3.145-beta
3.3.146-beta
3.3.147-beta
3.3.148-beta
3.4.152-beta
3.4.156
3.5.168-beta
3.5.169-beta
4.0.179
4.0.180
4.0.181
4.0.182
4.0.183
4.0.185
4.0.187
4.0.197
4.0.199
4.0.201
4.0.204
4.0.205
4.0.207
4.0.210
4.0.217
5.0.215-beta
5.0.218-beta
5.0.250-beta
5.0.266-beta
5.0.274-beta
5.0.298
5.0.304
5.0.310
5.0.319
5.0.331
5.0.342
5.0.343
5.0.353
5.0.355
5.0.372
5.0.376
5.0.404
6.0.409-beta
6.0.423-beta
6.0.430-beta
6.0.437
6.0.441
6.0.453
7.0.470-beta
7.0.473
7.1.475
7.1.488
7.1.509
7.1.512
7.1.542
8.0.601
8.0.645
8.0.690-beta
8.0.691-beta
8.0.692
8.0.718
8.1.717-beta
8.1.719-beta
Fixed in
8.0.723
8.1.722-beta
References Updated Feb 16, 2024 · Source: OSV.dev |