CVE-2026-113661

Deferred Deferred - Pending Action

Cross-Site Scripting via Meta Refresh in ApostropheCMS with sanitize-html

Publication date: 2026-10-20

Last updated on: 2026-10-21

Assigner: GitHub, Inc.

Description

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that allows meta refresh elements and their http-equiv and content attributes can retain unsafe script or redirect destinations embedded in the refresh content value. This issue is fixed in sanitize-html 2.18.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-21

Generated

2026-11-10

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-08

NVD

CVE-2026-113661

EUVD

EUVD-2026-105209

Affected Vendors & Products

Vendor	Product	Version / Range
apostrophecms	apostrophe	< 4.33.0
apostrophecms	sanitize-html	< 2.18.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

CVE-2026-113661 is a vulnerability in the sanitize-html npm package (versions before 2.18.0). It allows malicious JavaScript or data URLs to bypass sanitization when embedded in a meta refresh tag's content attribute. The issue occurs because the URL scheme check does not apply to the content attribute of a meta tag with http-equiv=refresh, enabling stored XSS or open redirect attacks.

Detection Guidance

To detect this vulnerability, check the version of the sanitize-html package in your project. Run: npm list sanitize-html. If the version is below 2.18.0, the system is vulnerable. Additionally, inspect HTML inputs or stored content for meta refresh tags with http-equiv="refresh" and content attributes containing URLs like javascript: or data:.

Impact Analysis

If you use a non-default configuration allowing meta refresh elements and their attributes, an attacker could inject malicious scripts or redirect URLs via the content attribute. This could lead to stored cross-site scripting attacks or unintended redirects, potentially compromising user sessions or data.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR or HIPAA if it leads to unauthorized data access or disclosure. Stored XSS or open redirects via malicious meta refresh tags might expose sensitive user data, triggering GDPR breach notifications or HIPAA violations for healthcare systems.

Mitigation Strategies

Immediately update the sanitize-html package to version 2.18.0 or later using: npm update sanitize-html. If updating is not possible, disable meta tag support or restrict the content attribute in meta tags to prevent unsafe URLs. Review and sanitize all user-provided HTML content to remove meta refresh tags with suspicious URLs.

Hi! I’m here to help you understand CVE-2026-113661. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...