CVE-2026-53606
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
ApostropheCMS, an open-source Node.js content management system, has a vulnerability in sanitize-html that allows dangerous URI schemes like 'javascript:' to pass through in HTML attributes. Versions prior to 2.17.5 do not block these schemes, leading to potential XSS attacks.
Risk Assessment
Organizations using vulnerable versions may be exposed to XSS attacks, which could result in data theft or session hijacking.
Recommendation
It is recommended to update sanitize-html to version 2.17.5 or later to block dangerous URI schemes.
Other vulnerabilities in sanitize-html
See all- CVE-2026-84371Medium
In ApostropheCMS (Node.js CMS) and the sanitize-html library (from version 1.9.0 to 2.17.7), there is a vulnerability in the sanitize-html package where the validation of the animation value attribute does not recognize that attributeName selecting href or xlink:href gives the sibling values from, to, or by SVG SMIL URL semantics. In configurations that allow animate, animateColor, animateMotion, animateTransform, or set elements, a values list can begin with a safe fragment and contain a later executable destination that survives allowedSchemesAppliedToAttributes checking. When the sanitized SVG is rendered, the browser can copy that later destination into the live link, and a victim who activates the link can execute script in the application's origin. This issue is fixed in version 2.17.7.
- CVE-2026-44990Critical
Vulnerability in sanitize-html library (versions prior to 2.17.4) in default configuration allows bypassing sanitization and injecting HTML/JavaScript via the <xmp> element. This can lead to stored XSS in applications rendering sanitized output.
Original NVD description (English source)
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Versions of sanitize-html prior to 2.17.5 use `allowedSchemesAppliedToAttributes` (default: `['href', 'src', 'cite']`) to gate the `naughtyHref()` function that blocks dangerous URI schemes like `javascript:` and `vbscript:`. The HTML specification defines 10+ attributes that accept URIs (`action`, `formaction`, `data`, `poster`, `background`, `ping`, `xlink:href`, `dynsrc`, `lowsrc`), but none of these are included in the default gate list. When a developer allows any of these attributes in their configuration, `javascript:` URIs pass through completely unmodified, enabling XSS. Version 2.17.5 patches the issue.