CVE-2022-21169 Prototype Pollution

High 7.3 Published 26 Sep 2022 Updated 21 May 2025

Attackers can bypass XSS sanitization via prototype pollution in the express-xss-sanitizer library, potentially allowing malicious script execution.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-21169?

CVE-2022-21169 is a high-severity vulnerability in express-xss-sanitizer, published on 26 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization.

Weakness: CWE-1321

Which versions are affected by CVE-2022-21169?

2 open source packages ship an affected version, including express-xss-sanitizer. It affects 1 product.

Package	Affected	Fixed in
`express-xss-sanitizer` npm	All versions	`1.1.3`
`express-xss-sanitizer` npm	All versions	`1.1.3`

Products include Express Xss Sanitizer Project Express Xss Sanitizer.

How do I fix CVE-2022-21169?

Upgrade express-xss-sanitizer to 1.1.3 or later.

Is CVE-2022-21169 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-21169 exists.

CVE-2026-33979 Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk) High 8.2

Sources

Also known as GHSA-grjp-4jmr-mjcw.