CVE-2026-113657
Deferred Deferred - Pending Action

SMIL SVG Animation Link Bypass in sanitize-html

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From sanitize-html 2.17.7 until 2.18.0, an application configuration that permits namespace-prefixed SVG animation elements and the relevant URL-targeting attributes can bypass the SMIL URL protection because prefixed tag names do not match the unprefixed animation-element check. The bypass can rewrite a link destination to an unsafe URI after the sanitized SVG is rendered, with script execution occurring when a user activates the affected link; the default sanitizer configuration is not unconditionally affected. This issue is fixed in sanitize-html 2.18.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-11-10
AI Q&A
2026-10-20
EPSS Evaluated
2026-11-08
NVD
CVE-2026-113657
EUVD
EUVD-2026-105186

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apostrophecms apostrophe < 4.33.0
apostrophecms sanitize-html >= 2.17.7, < 2.18.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the sanitize-html library versions 2.17.7 to 2.17.9. It allows bypassing SMIL animation XSS protection through namespace-prefix manipulation. The library fails to check namespace-prefixed SVG animation tags like svg:animate, enabling attackers to inject malicious JavaScript via URL attributes.

Detection Guidance

Check installed versions of sanitize-html. If using 2.17.7 to 2.17.9, the system is vulnerable. Inspect SVG content in applications for namespace-prefixed animation elements like svg:animate with href attributes.

Impact Analysis

An attacker could exploit this to rewrite link destinations to unsafe URIs. When a user clicks the affected link, script execution occurs. This primarily impacts applications using custom sanitizer configurations that permit SVG animation elements and URL-targeting attributes.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling cross-site scripting (XSS) attacks through SVG animation elements. If exploited, it may lead to unauthorized data access or modification, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Upgrade sanitize-html to version 2.18.0 or later. Review and restrict allowedTags configurations to prevent SVG animation elements. Monitor user-generated SVG content for suspicious namespace-prefixed tags.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113657. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...