Security readout for executives and security teams
Plain-English summary
sanitize-html could fail to neutralize hostile HTML when applications used its custom transformTags option. If exposed to user-submitted content, this could let an attacker make another user’s browser run script. The issue is medium severity because interaction is required and impact is browser-side confidentiality and integrity, not server compromise.
Executive priority
Treat as a focused web application remediation item. Prioritize internet-facing portals, admin consoles, and customer content features that render user-submitted HTML. It is not a crisis signal without active exploitation evidence, but public PoC availability makes delay unnecessary.
Technical view
CVE-2019-25225 is CWE-79 XSS in sanitize-html before 2.0.0-beta. The sanitizeHtml() function did not sanitize content correctly when custom transformTags converted attribute values into text, allowing malicious input to become executable code. CVSS 3.1 is 6.1: network reachable, low complexity, no privileges, user interaction required, changed scope.
Likely exposure
Exposure is most likely in Node.js applications using sanitize-html below 2.0.0-beta with custom transformTags on user-controlled HTML. Applications using the library only for trusted content, or not using transformTags, appear less exposed based on the supplied description.
Exploitation context
The bundle references a public proof-of-concept repository, so exploit knowledge is public. The CVE is not listed as KEV, and the provided sources do not show active exploitation in the wild. Successful abuse requires a victim to view attacker-influenced sanitized output.
Researcher notes
Key uncertainty is affected-version precision: the bundle states prior to 2.0.0-beta, while affected metadata is sparse. Validate actual dependency trees and transitive usage. Do not assume all sanitize-html deployments are vulnerable without confirming transformTags exposure and untrusted input flow.
Mitigation direction
- Upgrade sanitize-html to 2.0.0-beta or newer per the CVE description.
- Review vendor issue, pull request, and patch details for implementation-specific guidance.
- Audit custom transformTags usage handling untrusted HTML or attributes.
- Add output-encoding and CSP controls where user-generated HTML is rendered.
Validation and detection
- Inventory package manifests and lockfiles for sanitize-html versions below 2.0.0-beta.
- Search application code for sanitizeHtml() calls using custom transformTags.
- Confirm affected flows process user-controlled HTML and render results to browsers.
- Run regression tests covering transformed attributes and sanitized rendered output.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2019-25225 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N2.82.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.1MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/apostrophecms/sanitize-html/issues/293CVE reference · issue-tracking
- https://github.com/apostrophecms/sanitize-html/pull/156CVE reference
- https://github.com/apostrophecms/sanitize-html/commit/712cb6895825c8bb6ede71a16b42bade42abcaf3CVE reference · patch
- https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2019/CVE-2019-25225CVE reference · exploit
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.