CVE-2026-33979 Details
Description
Express XSS Sanitizer is Express 4.x and 5.x middleware which sanitizes user input data (in req.body, req.query, req.headers and req.params) to prevent Cross Site Scripting (XSS) attack. A vulnerability has been identified in versions prior to 2.0.2 where restrictive sanitization configurations are silently ignored. In version 2.0.2, the validation logic has been updated to respect explicitly provided empty configurations. Now, if allowedTags or allowedAttributes are provided (even if empty), they are passed directly to sanitize-html without being overridden.
A vulnerability exists in Express XSS Sanitizer middleware for Express versions 4.x and 5.x, specifically in versions through 2.0.1. The issue arises because the library ignores restrictive sanitization settings when developers explicitly define empty allowedTags or allowedAttributes. This oversight allows a broader range of HTML elements and attributes than intended, potentially leading to Cross-Site Scripting (XSS) attacks. The vulnerability occurs because the validation logic incorrectly assesses empty configurations as 'not provided', defaulting to more permissive settings that could be exploited, depending on how the sanitized output is used.
Users can upgrade to Express XSS Sanitizer version 2.0.2, where this vulnerability has been addressed by modifying the validation logic to properly respect empty allowedTags and allowedAttributes configurations.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-183 | Permissive List of Allowed Inputs | [email protected] |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| express xss sanitizer project express xss sanitizer | < 2.0.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 31, 2026 | Initial Analysis | [email protected] |
| Mar 27, 2026 | New CVE Received | [email protected] |