THREATOPS
THREAT OPS › Threat News › [GHSA] GHSA-vccv-cmxp-4j9h (medium) — sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes

[GHSA] GHSA-vccv-cmxp-4j9h (medium) — sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes

medgithub_advisoriesPublished 2026-07-31

GHSA-vccv-cmxp-4j9h Severity: medium CVE: CVE-2026-53606

sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes

## Summary

sanitize-html uses `allowedSchemesAppliedToAttributes` (default: `['href', 'src', 'cite']`) to gate the `naughtyHref()` function that blocks dangerous URI schemes like `javascrip

MITRE ATT&CK techniques

Indicators of compromise

Original source: https://github.com/advisories/GHSA-vccv-cmxp-4j9h