The express-xss-sanitizer middleware sanitizes user input in Express applications to prevent Cross-Site Scripting (XSS) attacks. In versions before 2.0.2, if restrictive sanitization configurations such as allowedTags or allowedAttributes were provided, they were silently ignored, resulting in a permissive sanitization policy that could allow malicious input to pass through. Version 2.0.2 fixes this by ensuring that explicitly provided empty configurations are respected and passed directly to the underlying sanitize-html library, thereby enforcing the intended sanitization rules. This vulnerability is identified as CVE-2026-33979 and has a CVSS 3.1 score of 8.2, indicating high severity due to its network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality and integrity.

The vulnerability allows potentially malicious input to bypass intended sanitization controls, increasing the risk of Cross-Site Scripting (XSS) attacks. This can lead to unauthorized script execution in the context of affected web applications, compromising data confidentiality and integrity. There is no indication of availability impact. No known exploits have been reported in the wild as of the provided data.

Users of express-xss-sanitizer should upgrade to version 2.0.2 or later, where the sanitization logic correctly respects restrictive configurations. Since no official patch links or vendor advisories are provided, users should verify the version in use and apply the update accordingly. Patch status is not explicitly confirmed beyond the version mention, so users should consult the official project repository or vendor advisory for the latest remediation guidance.