CVE-2026-33979: 
JavaScript vulnerability analysis and mitigation

CVE-2026-33979 is a sanitization bypass vulnerability in the express-xss-sanitizer npm package (versions ≤ 2.0.1) where explicitly restrictive configurations (allowedTags: [], allowedAttributes: {}) are silently ignored, causing the library to fall back to a permissive default HTML sanitization policy. This can result in content injection or cross-site scripting (XSS) depending on how the sanitized output is consumed. The vulnerability was published on March 25, 2026, and patched in version 2.0.2 released the same day. It carries a CVSS v3.1 base score of 8.2 (High) (Github Advisory, Security Advisory).

The root cause lies in flawed validation logic within lib/sanitize.js that checked for non-empty arrays/objects before passing options to the underlying sanitize-html library: allowedTags required length > 0 and allowedAttributes required Object.keys(...).length > 0. As a result, empty configurations ([] and {}) were treated as "not provided" and silently discarded, causing fallback to sanitize-html's default permissive configuration which allows tags such as <a>, <p>, and <div>, and attributes such as href. This is classified as CWE-79 (Cross-site Scripting) and CWE-183 (Permissive List of Allowed Inputs). The fix in commit 5623009 removes the length/emptiness checks, so any explicitly provided value — including empty arrays and objects — is passed directly to sanitize-html (Security Advisory, Patch Commit).

Applications that rely on express-xss-sanitizer with allowedTags: [] or allowedAttributes: {} to fully strip HTML from user input will unknowingly pass through a permissive set of HTML tags and attributes. This can enable injection of unintended HTML content (e.g., headings, paragraphs), injection of hyperlinks via href attributes, and potential XSS attacks if the sanitized output is rendered in a browser context. The integrity impact is rated High, with a Low confidentiality impact (e.g., via phishing links or data exfiltration through injected scripts), and no availability impact (Github Advisory).

A proof-of-concept (PoC) JavaScript snippet is publicly available in the GitHub Security Advisory, demonstrating that calling sanitize(input, { allowedTags: [], allowedAttributes: {} }) on a malicious HTML string returns the input unchanged rather than stripping it. No authentication or special privileges are required to trigger the vulnerable code path — exploitation depends only on an attacker being able to supply input to an affected application. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.021% (6th percentile), indicating low near-term exploitation probability (Github Advisory, Security Advisory).

1. Identify target: Find a Node.js/Express application using express-xss-sanitizer ≤ 2.0.1 that sanitizes user-supplied input with allowedTags: [] and/or allowedAttributes: {} before storing or rendering it.
2. Craft malicious payload: Prepare an HTML payload containing tags and attributes that should be stripped, such as <a href="http://evil.com">click</a><p>phish</p> or a script-bearing payload like <img src=x onerror=alert(1)>.
3. Submit payload: Send the crafted input through any user-facing input vector (form field, API request body, query parameter, or header) that is processed by the vulnerable sanitizer.
4. Bypass sanitization: Due to the flawed emptiness check, the library ignores the restrictive configuration and falls back to sanitize-html defaults, allowing the malicious HTML to pass through unsanitized.
5. Achieve impact: If the output is stored and later rendered in a browser (stored XSS), or reflected directly (reflected XSS), the injected HTML executes in the victim's browser context, enabling session hijacking, credential theft, or phishing (Security Advisory).

• Logs: Application logs showing user-submitted input containing HTML tags (e.g., <a href=, <script>, <img src=) being stored or returned in responses without stripping, particularly in fields expected to be plain text.
• Network: HTTP requests containing HTML-encoded or raw HTML payloads in body parameters, query strings, or headers targeting endpoints that use express-xss-sanitizer; outbound requests from client browsers to unexpected domains following page renders (indicative of injected links or scripts executing).
• Application Behavior: Rendered pages displaying unexpected HTML elements (hyperlinks, formatted text, images) in fields that should contain plain text; browser console errors related to blocked mixed content or CSP violations triggered by injected content.

Upgrade express-xss-sanitizer to version 2.0.2 or later, which corrects the validation logic to respect explicitly provided empty allowedTags and allowedAttributes configurations. No configuration-based workaround exists for the vulnerable versions — the only reliable fix is upgrading the package. After upgrading, developers should verify sanitization behavior by testing with known HTML payloads to confirm tags and attributes are properly stripped as intended (Security Advisory, v2.0.2 Release, Patch Commit).

The vulnerability was reported by security researcher lissy93 and disclosed by the maintainer AhmedAdelFahim via a GitHub Security Advisory on March 25, 2026. Social media activity was observed on Mastodon and Bluesky shortly after disclosure, with automated CVE tracking accounts sharing the advisory. No significant vendor statements beyond the maintainer's advisory or notable independent researcher commentary have been identified (Github Advisory).