CVE-2026-113661
Received Received - Intake

Cross-Site Scripting via Meta Refresh in ApostropheCMS with sanitize-html

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that allows meta refresh elements and their http-equiv and content attributes can retain unsafe script or redirect destinations embedded in the refresh content value. This issue is fixed in sanitize-html 2.18.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113661
EUVD
EUVD-2026-105209

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apostrophecms apostrophe < 4.33.0
apostrophecms sanitize-html < 2.18.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-113661 is a vulnerability in the sanitize-html npm package (versions before 2.18.0). It allows malicious JavaScript or data URLs to bypass sanitization when embedded in a meta refresh tag's content attribute. The issue occurs because the URL scheme check does not apply to the content attribute of a meta tag with http-equiv=refresh, enabling stored XSS or open redirect attacks.

Detection Guidance

To detect this vulnerability, check the version of the sanitize-html package in your project. Run: npm list sanitize-html. If the version is below 2.18.0, the system is vulnerable. Additionally, inspect HTML inputs or stored content for meta refresh tags with http-equiv="refresh" and content attributes containing URLs like javascript: or data:.

Impact Analysis

If you use a non-default configuration allowing meta refresh elements and their attributes, an attacker could inject malicious scripts or redirect URLs via the content attribute. This could lead to stored cross-site scripting attacks or unintended redirects, potentially compromising user sessions or data.

Mitigation Strategies

Immediately update the sanitize-html package to version 2.18.0 or later using: npm update sanitize-html. If updating is not possible, disable meta tag support or restrict the content attribute in meta tags to prevent unsafe URLs. Review and sanitize all user-provided HTML content to remove meta refresh tags with suspicious URLs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113661. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart