ApostropheCMS uses the sanitize-html library to filter user supplied HTML. Prior to version 2.18.0 a non‑default nonTextTags setting that includes the <noscript> tag can mis‑handle the parser’s implied close events. When the parser emits an implied ancestor close inside the <noscript> tag, the sanitizer prematurely ends the region that should be discarded. As a result, content that was intended to be inert can survive the sanitization process and be rendered by browsers. The unintended rendering of <noscript> payloads can lead to client‑side script execution (cross‑site scripting) if the injected content contains malicious code, compromising confidentiality, integrity, or availability of the web application.

The vulnerability affects any installation of the ApostropheCMS content management system that uses the sanitize-html library with a non‑default nonTextTags configuration that include the noscript element. Versions of sanitize-html older than 2.18.0 are impacted. The fix is implemented in sanitize-html 2.18.0 and later releases. No specific patch level is listed for ApostropheCMS itself, so any deployment that relies on sanitize-html prior to that release is vulnerable.

The CVSS score of 5.3 reflects a moderate severity vulnerability that can be exploited when a user submits HTML containing a <noscript> element with malicious content. The EPSS score is not available, so current exploit probability is unknown. The vulnerability is not listed in the CISA KEV catalog. An attacker with access to the CMS’s content entry points can craft an input that includes a <noscript> section containing JavaScript or other payloads. Because browsers treat <noscript> content as raw text, the payload would be rendered and executed when the page loads, enabling session hijacking, data theft, or defacement. The attack vector is web‑based, requiring interaction with a form or API that accepts HTML. The lack of validation or proper handling of <noscript> elevates the risk for users who navigate compromised content.