DOMPurify

Call DOMPurify.sanitize(html) and it parses the string with the browser's own HTML parser, walks the result and removes script tags, event-handler attributes such as onclick, javascript: links and other dangerous parts, while keeping ordinary markup such as paragraphs, links, lists and images. It handles HTML, SVG and MathML, and it can be configured to allow or forbid particular tags and attributes.

It is the usual choice whenever an app must display HTML it did not write: rendered Markdown, rich text from an editor such as Tiptap, emails or content from a CMS. The security firm Cure53 maintains it and updates it as new ways of smuggling script past sanitisers are found. It needs a DOM, so on a server it runs with jsdom or through the isomorphic-dompurify wrapper.

Browsers have started to ship a built-in Sanitizer API (element.setHTML); until every browser a site supports has it, DOMPurify remains the portable choice. Clean the HTML right before it is inserted, and keep the library updated.