Description
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From sanitize-html 2.17.7 until 2.18.0, an application configuration that permits namespace-prefixed SVG animation elements and the relevant URL-targeting attributes can bypass the SMIL URL protection because prefixed tag names do not match the unprefixed animation-element check. The bypass can rewrite a link destination to an unsafe URI after the sanitized SVG is rendered, with script execution occurring when a user activates the affected link; the default sanitizer configuration is not unconditionally affected. This issue is fixed in sanitize-html 2.18.0.
Published: 2026-10-20
Score: 3.7 Low
EPSS: n/a
KEV: No
Impact: Cross-Site Scripting (XSS) via URI injection
Action: Apply Patch
AI Analysis

Impact

sanitize-html between versions 2.17.7 and 2.18.0 lets an attacker bypass SMIL URL protection by using namespace-prefixed SVG animation elements. The bypass rewrites link targets to unsafe javascript: URIs, causing script execution when the link is activated. This vulnerability can lead to client-side code execution but does not provide a server-side compromise.

Affected Systems

ApostropheCMS and its on-demand sanitizer library sanitize-html are affected. Versions 2.17.7 through 2.18.0 contain the flaw while earlier and later releases are safe.

Risk and Exploitability

The CVSS score of 3.7 indicates moderate severity. No EPSS data is available and the issue is not listed in KEV, suggesting no widespread exploitation yet. The reliance on user-supplied SVG content and configuration of animation elements means attackers who can inject content may trigger the flaw, typically via XSS in a browser context.

Generated by OpenCVE AI on October 20, 2026 at 18:37 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade sanitize-html to version 2.18.0 or later
  • Change the sanitizer configuration to reject namespace-prefixed SVG animation elements and the URL-targeting attributes used for animation
  • Remove or clean existing SVG content that contains animations from untrusted data to mitigate stored XSS

Generated by OpenCVE AI on October 20, 2026 at 18:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-374f-7chj-9948 ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)
History

Tue, 20 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Description ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From sanitize-html 2.17.7 until 2.18.0, an application configuration that permits namespace-prefixed SVG animation elements and the relevant URL-targeting attributes can bypass the SMIL URL protection because prefixed tag names do not match the unprefixed animation-element check. The bypass can rewrite a link destination to an unsafe URI after the sanitized SVG is rendered, with script execution occurring when a user activates the affected link; the default sanitizer configuration is not unconditionally affected. This issue is fixed in sanitize-html 2.18.0.
Title ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-20T17:08:06.854Z

Reserved: 2026-10-20T14:27:46.641Z

Link: CVE-2026-113657

cve-icon Vulnrichment

Updated: 2026-10-20T17:08:00.724Z

cve-icon NVD

Status : Deferred

Published: 2026-10-20T17:17:36.780

Modified: 2026-10-20T19:53:10.247

Link: CVE-2026-113657

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T18:45:13Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')