This vulnerability occurs in the sanitize-html library that ships with ApostropheCMS. Versions prior to 2.18.0 allow the meta element with http-equiv=refresh and its content attribute to contain unsafe patterns such as javascript: or data: URLs. Because the library does not strip or neutralize these schemes, an attacker can cause the browser to execute arbitrary JavaScript or perform unintended redirects when the page is rendered. The flaw is a classic stored or reflected cross‑site scripting weakness, classified as CWE‑79.

ApostropheCMS users including the main CMS application and the independent sanitize-html package are affected. The vulnerability exists in any instance that includes sanitize‑html earlier than version 2.18.0, which is released in the 2.x series. The fix is included in sanitize‑html 2.18.0 and later, as indicated in the commit history and release notes cited in the advisory.

The CVSS score of 5.4 indicates a moderate risk. EPSS is not available, and the issue is not listed in CISA's KEV catalog, suggesting limited exploitation activity so far. The likely attack vector involves an authenticated content administrator inserting malicious payloads into pages that are sanitized but still retain the vulnerable meta tag, or a third‑party plugin that passes user input to the sanitizer. Once the payload is displayed to ordinary visitors, it can lead to XSS or phishing attacks.