apostrophecms sanitize-html vulnerabilities

Newest CVEs

• CVE-2026-113661

  ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

  apostrophecms · apostrophe

  Medium5.4
• CVE-2026-113657

  ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)

  apostrophecms · apostrophe

  Low3.7
• CVE-2026-113654

  ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render

  apostrophecms · apostrophe

  Medium5.3
• CVE-2026-113650

  ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)

  apostrophecms · apostrophe

  Medium5.3
• CVE-2026-53606

  sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and background attributes

  apostrophecms · sanitize-html

  Medium5.4
• CVE-2026-44990

  Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

  apostrophecms · sanitize-html

  Critical9.3
• CVE-2026-40186

  ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements

  apostrophecms · apostrophe

  Medium6.1