The sanitizer in ApostropheCMS incorrectly processes the animation value attribute of SVG SMIL elements. It fails to detect that when the attribute name is href or xlink:href, the value contains a sequence of URLs, allowing a malicious payload that begins with a benign fragment and ends with an executable destination. When a browser processes the sanitized SVG, it resolves the later destination and executes script in the context of the web application, giving an attacker the ability to exfiltrate data, hijack sessions, or deface the site. This is a classic stored cross‑site scripting vulnerability with same‑origin payload execution.

ApostropheCMS, a Node.js content management system, uses the sanitize‑html package. Versions from the initial release of 1.9.0 up through 2.17.7 are affected. The problem exists only when the sanitization configuration allows animate, animateColor, animateMotion, animateTransform, or set elements in user‑supplied content. All users of those versions, irrespective of deployment size, are in scope.

The CVSS base score of 5.4 signals a moderate severity. The exploit requires the attacker to deliver a malicious SVG fragment that contains the vulnerable attributes, which can be achieved through user uploads, editor input, or injected content. No exploitable public proof‑of‑concept is known, and the EPSS data is not available. The issue is not listed in CISA KEV, but the risk remains relevant for any application that accepts and renders SVG content without strict policy controls. Immediate patching or policy remediation is advised to eliminate the XSS vector.