CVSS 3.1
8.2 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:NCVE-2026-33979
High (8.2) in express xss sanitizer project express xss sanitizer. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in express-xss-sanitizer 2.0.2.
Express XSS Sanitizer is Express 4.x and 5.x middleware which sanitizes user input data (in req.body, req.query, req.headers and req.params) to prevent Cross Site Scripting (XSS) attack. A vulnerability has been identified in versions prior to 2.0.2 where restrictive sanitization configurations are silently ignored. In version 2.0.2, the validation logic has been updated to respect explicitly provided empty configurations. Now, if allowedTags or allowedAttributes are provided (even if empty), they are passed directly to sanitize-html without being overridden.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 33% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-79, CWE-183
- Published
- Modified
- Record from
- the NVD, synced
Affected
- express_xss_sanitizer_project:express_xss_sanitizer
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-3843-rr4g-m8jq | npm | express-xss-sanitizer | <2.0.2 | 2.0.2 |