CVE-2026-33979
Silent Bypass of XSS Sanitization in Express XSS Sanitizer
Publication date: 2026-03-27
Last updated on: 2026-03-31
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| express_xss_sanitizer_project | express_xss_sanitizer | to 2.0.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-183 | The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in Express XSS Sanitizer versions prior to 2.0.2. This middleware is designed to sanitize user input data to prevent Cross Site Scripting (XSS) attacks. However, in affected versions, restrictive sanitization configurations are silently ignored, meaning that if a user explicitly sets allowedTags or allowedAttributes (even as empty), these settings are not respected and are overridden. This flaw allows potentially unsafe input to bypass the intended sanitization.
How can this vulnerability impact me? :
This vulnerability can lead to Cross Site Scripting (XSS) attacks because the sanitization configurations meant to restrict harmful input are ignored. As a result, malicious scripts could be injected and executed in the context of a user's browser, potentially leading to data theft, session hijacking, or other malicious activities.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Express XSS Sanitizer middleware to version 2.0.2 or later. This version includes updated validation logic that respects explicitly provided empty configurations, ensuring that restrictive sanitization settings are not silently ignored.