Sourced from sanitize-html's changelog.
2.17.3 (2026-04-15)
Security
- Fix vulnerability introduced in version 2.17.2 that allowed XSS attacks if the developer chose to permit
optiontags. There was no vulnerability when not explicitly allowingoptiontags.2.17.2 (2026-03-19)
Changes
- Upgrade
htmlparser2from 8.x to 10.1.0. This improves security by correctly decoding zero-padded numeric character references (e.g.,&[#0000001](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html/issues/0000001)) that previously bypassedjavascript:URL detection. Also fixes double-encoding of entities inside raw text elements liketextareaandoption.2.17.1 (2026-02-18)
Fixes
- Fix unclosed tags (e.g.,
<hello) returning empty string inescapeandrecursiveEscapemodes. Fixes #706. Thanks to Byeong Hyeon for the fix.
96cf174
For release only (#5381)7ca2d16
Merge commit from fork297a422
Bump dependencies (#5376)7e607c9
Changelog reconciliation for release (#5359)49d0bb7
Port/sanitize html community contrib (#5337)a9ca4ef
For release only (#5328)bbf3359
Port sanitize html standalone pr (#5323)f5f266c
Adds changeset (#5209)c9aba85
PRO-8756: monorepo workflows (#5179)107bcd2
Pro 8756 monorepo switch (#5177)