A vulnerability in the express-xss-sanitizer middleware for Express applications allows unauthenticated attackers to bypass intended security filters, leading to potential Cross Site Scripting (XSS).

This vulnerability occurs because the middleware silently ignores restrictive sanitization configurations, such as empty allowedTags or allowedAttributes, leading to improper input neutralization. The flaw is exploitable by unauthenticated remote users who provide malicious input via request bodies, query parameters, headers, or URL parameters.

Successful exploitation of this vulnerability can result in unauthorized script execution within a user browser session. This may lead to the theft of session cookies, sensitive data exposure, or the redirection of users to malicious websites, causing significant reputational and operational damage. With a CVSS score of 8.2, this issue is classified as High severity due to the potential for high impact on data integrity and the lack of required authentication.

Immediate Action: Update the express-xss-sanitizer package to version 2.0.2 or later to ensure that custom sanitization configurations are correctly respected.

Proactive Monitoring: Review application logs for suspicious input patterns, specifically looking for common XSS payloads in request headers, query strings, and body data.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with robust XSS detection rules to inspect incoming requests and filter out potentially malicious scripts before they reach the application backend.

Public Exploit Available: Unknown.

Given the High severity of this flaw and its potential to facilitate Cross Site Scripting attacks, organizations should prioritize updating the express-xss-sanitizer library immediately. Failure to patch allows attackers to bypass security filters, putting end-user sessions and data at significant risk. Apply the version 2.0.2 update as part of the next maintenance cycle to ensure full protection against this sanitization failure.