Vulnerability · Published Mar 27, 2026 · Assigned by GitHub_M

CVE-2026-33979Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)

High 8.2

In plain English

A high-severity cross-site scripting in express-xss-sanitizer from AhmedAdelFahim. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.4%top 66.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Express XSS Sanitizer is Express 4.x and 5.x middleware which sanitizes user input data (in req.body, req.query, req.headers and req.params) to prevent Cross Site Scripting (XSS) attack. A vulnerability has been identified in versions prior to 2.0.2 where restrictive sanitization configurations are silently ignored. In version 2.0.2, the validation logic has been updated to respect explicitly provided empty configurations. Now, if allowedTags or allowedAttributes are provided (even if empty), they are passed directly to sanitize-html without being overridden.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	express-xss-sanitizer	2.0.2	GHSA-3843-rr4g-m8jq

Affected products (as reported)

Vendor	Product	Versions
AhmedAdelFahim	express-xss-sanitizer	< 2.0.2

Weakness: CWE-183, CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

References

https://github.com/AhmedAdelFahim/express-xss-sanitizer/security/advisories/GHSA-3843-rr4g-m8jq x_refsource_CONFIRM
https://github.com/AhmedAdelFahim/express-xss-sanitizer/commit/5623009ef11dcf095c163a38dea07b9cc22ad19f x_refsource_MISC
https://github.com/AhmedAdelFahim/express-xss-sanitizer/releases/tag/v2.0.2 x_refsource_MISC