The Express XSS Sanitizer middleware intended to clean user input incorrectly ignores configurations for allowedTags or allowedAttributes. When these options are provided—even as empty arrays—the middleware passes them directly to a sanitization routine that defaults to permissive behaviour. As a result, malicious scripts injected into request bodies, queries, headers or parameters can bypass the sanitizer, allowing arbitrary JavaScript execution in the victim’s browser. The weakness is a classic cross‑site scripting flaw, corresponding to CWE‑79. The likely attack vector is an attacker who can send crafted HTTP requests to the application, but this conclusion is inferred from the description because the entry does not explicitly state the vector.

The problem affects the AhmedAdelFahim Express XSS Sanitizer package used as middleware in Express 4.x and 5.x applications. All versions before 2.0.2 are vulnerable; upgrading to 2.0.2 or later resolves the issue. Applications that rely on the package for input sanitization are at risk if they have not applied the patch or if they configure the options incorrectly.

The CVSS base score of 8.2 classifies the flaw as high‑severity, indicating significant impact on confidentiality, integrity, and availability of the affected web service. The EPSS score is below 1%, suggesting a low probability of current exploitation, and the flaw is not listed in CISA’s KEV catalog. Nonetheless, because the vulnerability enables arbitrary code execution via forged web requests, the potential damage is considerable and the recommended remediation is immediate.