CVE-2026-40186

@@ -0,0 +1,5 @@
+---
+"sanitize-html": patch
+---
+
+Fix vulnerability introduced in version 2.17.2 that allowed XSS attacks if the developer chose to permit `option` tags. There was no vulnerability when not explicitly allowing `option` tags.

@@ -566,10 +566,14 @@ function sanitizeHtml(html, options, _recursing) {
         // your concern, don't allow them. The same is essentially true for style tags
         // which have their own collection of XSS vectors.
         result += text;
-      } else if ((options.disallowedTagsMode === 'discard' || options.disallowedTagsMode === 'completelyDiscard') && (nonTextTagsArray.indexOf(tag) !== -1)) {
-        // htmlparser2 does not decode entities inside raw text elements like
-        // textarea and option. The text is already properly encoded, so pass
-        // it through without additional escaping to avoid double-encoding.
+      } else if ((options.disallowedTagsMode === 'discard' || options.disallowedTagsMode === 'completelyDiscard') && (tag === 'textarea' || tag === 'xmp')) {
+        // htmlparser2 treats <textarea> and <xmp> as raw text elements and
+        // does NOT decode entities inside them. The text is already properly
+        // encoded, so pass it through without additional escaping to avoid
+        // double-encoding. Other "nonTextTags" like <option> are not raw text
+        // elements in htmlparser2, so their contents are decoded and must be
+        // escaped below like any other text (important to prevent XSS via
+        // entity-encoded payloads such as <option>&lt;script&gt;...&lt;/script&gt;</option>).
         result += text;
       } else if (!addedText) {
         const escaped = escapeHtml(text, false);

@@ -1896,4 +1896,30 @@ describe('sanitizeHtml', function() {
 
     assert.equal(sanitizedHtmlPreservedAttrsTrue, sanitizedHtmlPreservedAttrsFalse);
   });
+  it('should not allow script tag injection via escaped entities in option tag', () => {
+    const inputHtml = '<option>&lt;script&gt;alert(1)&lt;/script&gt;</option>';
+    const result = sanitizeHtml(inputHtml, { allowedTags: ['option'] });
+    assert.strictEqual(result, '<option>&lt;script&gt;alert(1)&lt;/script&gt;</option>');
+  });
+  it('should not double-encode entities inside an allowed option element', function() {
+    assert.equal(
+      sanitizeHtml('<option>&lt;div&gt;hello&lt;/div&gt;&amp;amp;</option>',
+        { allowedTags: [ 'option' ] }
+      ), '<option>&lt;div&gt;hello&lt;/div&gt;&amp;amp;</option>'
+    );
+  });
+  it('should not double-encode entities inside an allowed xmp element', function() {
+    assert.equal(
+      sanitizeHtml('<xmp>&lt;div&gt;hello&lt;/div&gt;&amp;amp;</xmp>',
+        { allowedTags: [ 'xmp' ] }
+      ), '<xmp>&lt;div&gt;hello&lt;/div&gt;&amp;amp;</xmp>'
+    );
+  });
+  it('should correctly maintain escaping when allowing an xmp element', function() {
+    assert.equal(
+      sanitizeHtml('!<xmp>&lt;/xmp&gt;&lt;svg/onload=prompt`xs`&gt;</xmp>!',
+        { allowedTags: [ 'xmp' ] }
+      ), '!<xmp>&lt;/xmp&gt;&lt;svg/onload=prompt`xs`&gt;</xmp>!'
+    );
+  });
 });