apostrophecms sanitize-html
7 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-113661 | < 2.18.0 | ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-113657 | >= 2.17.7, < 2.18.0 | ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS) | LOW 3.7 | 0.3 % | ||
| CVE-2026-113654 | < 2.18.0 | ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-113650 | >= 2.18.0, < 2.18.1 | ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not … | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-53606 | < 2.17.5 | sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and backgrou… | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-44990 | < 2.17.4 | Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` | CRITICAL 9.3 | 0.7 % | ||
| CVE-2026-40186 | >= 2.17.1, < 2.17.2 | ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements | MEDIUM 6.1 | 0.2 % |