CVE-2026-113654

Deferred Deferred - Pending Action

HTML Sanitization Bypass in ApostropheCMS via sanitize-html

Publication date: 2026-10-20

Last updated on: 2026-10-28

Assigner: GitHub, Inc.

Description

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration that includes noscript can end its discard region early when htmlparser2 emits an implied ancestor close inside noscript. Because scripting-enabled browsers treat noscript content as raw text while the parser does not model that mode, content intended to remain inert can survive sanitization and render; the issue does not generalize to every default nonTextTags element. This issue is fixed in sanitize-html 2.18.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-08

NVD

CVE-2026-113654

EUVD

EUVD-2026-105182

Affected Vendors & Products

Vendor	Product	Version / Range
apostrophecms	apostrophe	< 4.33.0
apostrophecms	sanitize-html	< 2.18.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability affects sanitize-html versions before 2.18.0. It occurs when the nonTextTags configuration includes noscript. The sanitizer ends discard regions early due to implied ancestor closures in noscript tags. Browsers treat noscript content as raw text while the sanitizer processes it as HTML, allowing malicious content to bypass sanitization and potentially inject elements like images or links.

Detection Guidance

To detect this vulnerability, check the version of sanitize-html in your ApostropheCMS installation. Run: npm list sanitize-html. If the version is below 2.18.0, the system is vulnerable.

Impact Analysis

This vulnerability could allow attackers to inject malicious scripts or content into web pages that use affected versions of sanitize-html. This may lead to cross-site scripting (XSS) attacks, where unauthorized code executes in a user's browser, potentially stealing data or performing actions on their behalf.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using affected versions may face compliance risks due to potential data breaches or unauthorized script execution.

Mitigation Strategies

Upgrade sanitize-html to version 2.18.0 or later using: npm update sanitize-html. If immediate upgrade is not possible, review and sanitize all user-generated content containing <noscript> tags manually.

Hi! I’m here to help you understand CVE-2026-113654. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...