GHSA-cv27-6wvh-8x7j

Summary

CVE-2026-53606 expanded allowedSchemesAppliedToAttributes so named URL attributes (action, formaction, data, poster, background, later ping, xlink:href, …) go through naughtyHref(). A URL nested inside meta content (http-equiv=refresh) is not an attribute name on that list, so the embedded destination is never scheme-checked.

Default allowedTags still omit meta. Same non-default integrator config as 53606: allow meta plus http-equiv / content.

On 2.17.7:

sanitizeHtml(
  '<meta http-equiv="refresh" content="0;url=javascript:alert(1)">',
  { allowedTags: ['meta'], allowedAttributes: { meta: ['http-equiv', 'content'] } }
)
// => <meta http-equiv="refresh" content="0;url=javascript:alert(1)" />

data:text/html,… and arbitrary https: destinations also survive. formaction="javascript:…" (53606) is stripped.

Please Request CVE. Credit: Finder + Reporter (adrbogacz).

Details

naughtyHref() only runs when the attribute name is in allowedSchemesAppliedToAttributes (index.js ~385). Refresh URLs live in a content value of the form 0;url=…, so the gate never fires. Adding content to that list wholesale would break ordinary meta content (description, viewport).

Fix: when http-equiv is refresh (case-insensitive), parse the ; url= destination and run naughtyHref('meta', url). Drop content (or the tag) if the URL is rejected. Leave other meta content values alone.

PoC

Local sanitize-html@2.17.7. Output inspection only:

node -e '
const sanitize = require("sanitize-html");
const opts = { allowedTags: ["meta"], allowedAttributes: { meta: ["http-equiv", "content"] } };
for (const html of [
  "<meta http-equiv=\"refresh\" content=\"0;url=javascript:alert(1)\">",
  "<meta http-equiv=\"refresh\" content=\"0;url=data:text/html,aaa\">",
  "<form><button formaction=\"javascript:alert(1)\">x</button></form>",
]) {
  console.log(html, "=>", sanitize(html, html.includes("meta") ? opts : { allowedTags: ["form","button"], allowedAttributes: { button: ["formaction"] } }));
}
'

Expected: refresh javascript: / data: remain; 53606 formaction is removed. Do not attach a browser hang or stored-XSS page.

Impact

An integrator who allowed meta + content expecting allowedSchemes to apply (the 53606 configuration pattern) still emits a refresh to javascript:, data:, or an attacker https: URL. Stored XSS / open redirect for viewers of that HTML. Default config is not affected.