Summaryinfo

A vulnerability categorized as critical has been discovered in AhmedAdelFahim express-xss-sanitizer up to 2.0.1. This affects an unknown function. The manipulation of the argument req.body/req.query/req.headers/req.params results in permissive list of allowed inputs. This vulnerability is cataloged as CVE-2026-33979. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in AhmedAdelFahim express-xss-sanitizer up to 2.0.1. Affected is an unknown functionality. The manipulation of the argument req.body/req.query/req.headers/req.params with an unknown input leads to a permissive list of allowed inputs vulnerability. CWE is classifying the issue as CWE-183. The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Express XSS Sanitizer is Express 4.x and 5.x middleware which sanitizes user input data (in req.body, req.query, req.headers and req.params) to prevent Cross Site Scripting (XSS) attack. A vulnerability has been identified in versions prior to 2.0.2 where restrictive sanitization configurations are silently ignored. In version 2.0.2, the validation logic has been updated to respect explicitly provided empty configurations. Now, if allowedTags or allowedAttributes are provided (even if empty), they are passed directly to sanitize-html without being overridden.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-33979 since 03/24/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit.

Upgrading to version 2.0.2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 5623009ef11dcf095c163a38dea07b9cc22ad19f is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• AhmedAdelFahim

Name

• express-xss-sanitizer

Version

• 2.0.0
• 2.0.1

License

• open-source

Website

• Product: https://github.com/AhmedAdelFahim/express-xss-sanitizer/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion