CVE-2026-113657
LowCVSS 3.7Summary
In sanitize-html from 2.17.7 until 2.18.0, an application configuration that permits namespace-prefixed SVG animation elements and the relevant URL-targeting attributes can bypass the SMIL URL protection because prefixed tag names do not match the unprefixed animation-element check. The bypass can rewrite a link destination to an unsafe URI after the sanitized SVG is rendered, with script execution occurring when a user activates the affected link. The default sanitizer configuration is not unconditionally affected.
Risk Assessment
Users of ApostropheCMS may be tricked into clicking a crafted link in sanitized SVG, potentially leading to malicious script execution in the victim's browser context. Risk applies to installations with custom sanitize-html configuration permitting prefixed SVG animation elements.
Recommendation
Upgrade sanitize-html to version 2.18.0 or later. Review sanitizer configuration for allowances of prefixed SVG animation elements and URL-targeting attributes.
Other vulnerabilities in sanitize-html
See all- CVE-2026-113661Medium
In sanitize-html before 2.18.0, a non-default configuration that allows meta refresh elements and their http-equiv and content attributes can retain unsafe script or redirect destinations embedded in the refresh content value. This affects ApostropheCMS using sanitize-html. The issue is fixed in sanitize-html 2.18.0.
- CVE-2026-44990Critical
Vulnerability in sanitize-html library (versions prior to 2.17.4) in default configuration allows bypassing sanitization and injecting HTML/JavaScript via the <xmp> element. This can lead to stored XSS in applications rendering sanitized output.
- CVE-2026-113654Medium
Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration that includes noscript can end its discard region early when htmlparser2 emits an implied ancestor close inside noscript. Because scripting-enabled browsers treat noscript content as raw text while the parser does not model that mode, content intended to remain inert can survive sanitization and render.
- CVE-2026-113650Medium
In sanitize-html 2.18.0, when an <iframe> is not allowed and disallowedTagsMode is 'discard' (the defaults), its raw-text content is re-sanitized by a recursive call to sanitizeHtml(text, options). The recursion has no bound and starts each nested call with a fresh state.
- CVE-2026-84371Medium
In ApostropheCMS (Node.js CMS) and the sanitize-html library (from version 1.9.0 to 2.17.7), there is a vulnerability in the sanitize-html package where the validation of the animation value attribute does not recognize that attributeName selecting href or xlink:href gives the sibling values from, to, or by SVG SMIL URL semantics. In configurations that allow animate, animateColor, animateMotion, animateTransform, or set elements, a values list can begin with a safe fragment and contain a later executable destination that survives allowedSchemesAppliedToAttributes checking. When the sanitized SVG is rendered, the browser can copy that later destination into the live link, and a victim who activates the link can execute script in the application's origin. This issue is fixed in version 2.17.7.
- CVE-2026-53606Medium
ApostropheCMS, an open-source Node.js content management system, has a vulnerability in sanitize-html that allows dangerous URI schemes like 'javascript:' to pass through in HTML attributes. Versions prior to 2.17.5 do not block these schemes, leading to potential XSS attacks.
Original NVD description (English source)
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From sanitize-html 2.17.7 until 2.18.0, an application configuration that permits namespace-prefixed SVG animation elements and the relevant URL-targeting attributes can bypass the SMIL URL protection because prefixed tag names do not match the unprefixed animation-element check. The bypass can rewrite a link destination to an unsafe URI after the sanitized SVG is rendered, with script execution occurring when a user activates the affected link; the default sanitizer configuration is not unconditionally affected. This issue is fixed in sanitize-html 2.18.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS