Cross-Site Scripting in sanitize-html

Affected versions of sanitize-html are vulnerable to cross-site scripting.

Proof of Concept:

<IMG SRC= onmouseover="alert('XSS');">
produces the following:

<img src="onmouseover="alert('XSS');"" />
This is definitely invalid HTML, but would suggest that it's being interpreted incorrectly by the parser.

Recommendation

Update to version 1.2.3 or later.