CVE-2026-33979: Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)

A vulnerability has been identified in express-xss-sanitizer (<= 2.0.1) where restrictive sanitization configurations are silently ignored.

When a developer explicitly sets:

allowedTags: [] allowedAttributes: {}

the library incorrectly treats these values as “not provided” due to length/emptiness checks, and falls back to sanitize-html’s default configuration.

As a result, instead of stripping all HTML tags and attributes, the sanitizer allows a permissive set of tags (e.g., <a>, <p>, <div>, etc.) and attributes (e.g., href on <a>).

This behavior violates the expected API contract and may lead to security issues such as content injection or XSS, depending on how the sanitized output is used.