{"id":"CVE-2026-53606","revision":null,"records":[{"revision":"c9b7934f9f3a465ab060b52b79ea9f2e","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-53606","aliases":[],"title":"sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and background attributes","description":"ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Versions of sanitize-html prior to 2.17.5 use `allowedSchemesAppliedToAttributes` (default: `['href', 'src', 'cite']`) to gate the `naughtyHref()` function that blocks dangerous URI schemes like `javascript:` and `vbscript:`. The HTML specification defines 10+ attributes that accept URIs (`action`, `formaction`, `data`, `poster`, `background`, `ping`, `xlink:href`, `dynsrc`, `lowsrc`), but none of these are included in the default gate list. When a developer allows any of these attributes in their configuration, `javascript:` URIs pass through completely unmodified, enabling XSS. Version 2.17.5 patches the issue.","state":0,"publishedAt":"2026-06-12T20:50:47.085+00:00","modifiedAt":"2026-06-15T17:54:23.511+00:00","affected":[{"ecosystem":"Vendor product","name":"sanitize-html","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"apostrophecms\",\n                    \"product\": \"sanitize-html\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 2.17.5\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","score":5.4,"severity":"MEDIUM"}],"references":["https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vccv-cmxp-4j9h"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-53606","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-53606","identifiers":["CVE-2026-53606"]},"retained":false,"historicalAffected":[]},{"revision":"79c1a67e36384762aa64a117a8695485","observedAt":"2026-11-07T11:38:04.14+00:00","statement":{"source":"euvd","id":"EUVD-2026-36574","aliases":["CVE-2026-53606","GHSA-vccv-cmxp-4j9h"],"title":"ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Versions of sanitize-html prior to 2.17.5 use `allowedSchemesAppliedToAttributes` (default: `['href', 's…","description":"ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Versions of sanitize-html prior to 2.17.5 use `allowedSchemesAppliedToAttributes` (default: `['href', 'src', 'cite']`) to gate the `naughtyHref()` function that blocks dangerous URI schemes like `javascript:` and `vbscript:`. The HTML specification defines 10+ attributes that accept URIs (`action`, `formaction`, `data`, `poster`, `background`, `ping`, `xlink:href`, `dynsrc`, `lowsrc`), but none of these are included in the default gate list. When a developer allows any of these attributes in their configuration, `javascript:` URIs pass through completely unmodified, enabling XSS. Version 2.17.5 patches the issue.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","score":5.4,"severity":null}],"references":["https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vccv-cmxp-4j9h"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-36574","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 12, 2026, 8:50:47 PM","dateUpdated":"Jun 15, 2026, 5:54:23 PM"},"relatedAdvisories":[{"id":"SUSE-SU-2026:4606-1","title":"Security update for golang-github-prometheus-prometheus","vulnerabilityIds":["CVE-2023-45289","CVE-2025-4673","CVE-2025-61686","CVE-2026-2303","CVE-2026-39821","CVE-2026-40181","CVE-2026-42211","CVE-2026-42342","CVE-2026-44990","CVE-2026-53606","CVE-2026-56852"]},{"id":"SUSE-SU-2026:4585-1","title":"Security update 5.2.1 for Multi-Linux Manager Client Tools","vulnerabilityIds":["CVE-2023-45289","CVE-2024-22195","CVE-2025-13836","CVE-2025-4673","CVE-2025-61686","CVE-2026-0864","CVE-2026-11940","CVE-2026-11972","CVE-2026-1229","CVE-2026-13346","CVE-2026-14199","CVE-2026-1502","CVE-2026-15308","CVE-2026-1703","CVE-2026-17033","CVE-2026-17183","CVE-2026-19197","CVE-2026-19475","CVE-2026-21723","CVE-2026-2303","CVE-2026-27459","CVE-2026-3219","CVE-2026-3276","CVE-2026-33814","CVE-2026-3446","CVE-2026-3479","CVE-2026-39821","CVE-2026-39882","CVE-2026-40181","CVE-2026-40475","CVE-2026-41066","CVE-2026-41178","CVE-2026-41606","CVE-2026-42127","CVE-2026-42211","CVE-2026-42342","CVE-2026-4360","CVE-2026-44431","CVE-2026-44990","CVE-2026-45409","CVE-2026-4786","CVE-2026-49825","CVE-2026-49853","CVE-2026-49854","CVE-2026-49855","CVE-2026-53606","CVE-2026-56852","CVE-2026-6019","CVE-2026-6100","CVE-2026-6357","CVE-2026-7210","CVE-2026-73501","CVE-2026-7774","CVE-2026-8328","CVE-2026-8595","CVE-2026-8609","CVE-2026-8643","CVE-2026-9029"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-36574","identifiers":["EUVD-2026-36574","CVE-2026-53606","GHSA-vccv-cmxp-4j9h"]},"retained":false,"historicalAffected":[]},{"revision":"26e0add257a5466b85f142b2b049b3ff","observedAt":"2026-10-27T14:13:22.737+00:00","statement":{"source":"nvd","id":"CVE-2026-53606","aliases":[],"title":"ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Versions of sanitize-html prior to 2.17.5 use `allowedSchemesAppliedToAttributes` (default: `['href', 's…","description":"ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Versions of sanitize-html prior to 2.17.5 use `allowedSchemesAppliedToAttributes` (default: `['href', 'src', 'cite']`) to gate the `naughtyHref()` function that blocks dangerous URI schemes like `javascript:` and `vbscript:`. The HTML specification defines 10+ attributes that accept URIs (`action`, `formaction`, `data`, `poster`, `background`, `ping`, `xlink:href`, `dynsrc`, `lowsrc`), but none of these are included in the default gate list. When a developer allows any of these attributes in their configuration, `javascript:` URIs pass through completely unmodified, enabling XSS. Version 2.17.5 patches the issue.","state":0,"publishedAt":"2026-06-12T21:16:24.093+00:00","modifiedAt":"2026-10-25T23:10:00.167+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","score":5.4,"severity":"MEDIUM"}],"references":["https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vccv-cmxp-4j9h"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53606","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-79"],"productCriteria":[],"sourceDates":{"published":"2026-06-12T21:16:24.093","lastModified":"2026-10-25T23:10:00.167"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-53606","identifiers":["CVE-2026-53606"]},"retained":false,"historicalAffected":[]},{"revision":"76a25d1fe54b4a349b3a3abd8511acc5","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-vccv-cmxp-4j9h","aliases":["CVE-2026-53606"],"title":"sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes","description":"## Summary\n\nsanitize-html uses `allowedSchemesAppliedToAttributes` (default: `['href', 'src', 'cite']`) to gate the `naughtyHref()` function that blocks dangerous URI schemes like `javascript:` and `vbscript:`. The HTML specification defines 10+ attributes that accept URIs (`action`, `formaction`, `data`, `poster`, `background`, `ping`, `xlink:href`, `dynsrc`, `lowsrc`), but none of these are included in the default gate list. When a developer allows any of these attributes in their configuration, `javascript:` URIs pass through completely unmodified, enabling XSS.\n\nThe library has zero awareness of these URI-bearing attributes — none appear anywhere in the 854-line source file (verified by grep). No warning mechanism exists, and the README provides no security guidance about expanding `allowedSchemesAppliedToAttributes` when allowing form or media attributes.\n\n## Severity\n\nExploitation requires non-default configuration: the developer must explicitly allow a non-default tag (e.g., `form`) AND a non-default attribute (e.g., `action`). Default configuration is NOT vulnerable. However, this is a common configuration pattern for CMS platforms, form builders, and rich content editors.\n\n## Affected Versions\n\nAll versions of sanitize-html from v1.18.0 (which introduced `allowedSchemesAppliedToAttributes`) through at least v2.17.2. The default list has been `['href', 'src', 'cite']` since introduction and has never been expanded.\n\n## Root Cause\n\n**File**: `index.js:329` (sanitize-html 2.10.0, confirmed same in 2.17.x)\n\n```javascript\n// Line 329 — The gate that controls scheme validation\nif (options.allowedSchemesAppliedToAttributes.indexOf(a) >= 0) {\n    if (naughtyHref(name, value)) {\n        delete frame.attribs[a];\n        return;\n    }\n}\n```\n\n**Default list at line 829**:\n```javascript\nallowedSchemesAppliedToAttributes: ['href', 'src', 'cite'],\n```\n\nThe `naughtyHref()` function (lines 627-667) correctly blocks `javascript:`, `vbscript:`, and other dangerous schemes. However, it has exactly 2 call sites in the entire codebase (lines 330 and 395), both inside the `indexOf` gate. There is no ungated path.\n\nWhen attribute name is `action`, `formaction`, `data`, `poster`, `background`, etc.:\n- `indexOf('action')` returns `-1`\n- The `if` block is skipped entirely\n- `naughtyHref()` is never called\n- `javascript:alert(1)` passes through unmodified\n\nThe `escapeHtml()` function at line 464 provides no defense — it only encodes `& < > \"` characters, which are not present in `javascript:alert(1)`.\n\n**Data Flow**:\n```\nAttacker input: <form action=\"javascript:alert(document.cookie)\">\n1. htmlparser2 parses → tag='form', attribs={action:'javascript:alert(document.cookie)'}\n2. index.js:298 → allowedAttributes check: 'action' in developer config → PASS\n3. index.js:329 → ['href','src','cite'].indexOf('action') → -1 → SKIP naughtyHref()\n4. index.js:464 → escapeHtml('javascript:alert(document.cookie)') → unchanged\n5. OUTPUT: <form action=\"javascript:alert(document.cookie)\">\n```\n\n## Steps to Reproduce\n\n```javascript\nconst sanitize = require('sanitize-html');\n\n// ===== VECTOR 1: form action (100% reliable, all modern browsers) =====\nconst v1 = sanitize(\n    '<form action=\"javascript:alert(document.cookie)\"><button>Submit</button></form>',\n    {\n        allowedTags: ['form', 'button'],\n        allowedAttributes: { form: ['action'] }\n    }\n);\nconsole.log('V1 (action):', v1);\n// OUTPUT: <form action=\"javascript:alert(document.cookie)\"><button>Submit</button></form>\n// XSS triggers when user submits the form\n\n// ===== VECTOR 2: button formaction (100% reliable) =====\nconst v2 = sanitize(\n    '<button formaction=\"javascript:alert(1)\">Click</button>',\n    {\n        allowedTags: ['button'],\n        allowedAttributes: { button: ['formaction'] }\n    }\n);\nconsole.log('V2 (formaction):', v2);\n// OUTPUT: <button formaction=\"javascript:alert(1)\">Click</button>\n\n// ===== VECTOR 3: object data =====\nconst v3 = sanitize(\n    '<object data=\"javascript:alert(1)\"></object>',\n    {\n        allowedTags: ['object'],\n        allowedAttributes: { object: ['data'] }\n    }\n);\nconsole.log('V3 (data):', v3);\n// OUTPUT: <object data=\"javascript:alert(1)\"></object>\n\n// ===== CONTROL: href IS scheme-checked (expected behavior) =====\nconst ctrl = sanitize(\n    '<a href=\"javascript:alert(1)\">click</a>',\n    {\n        allowedTags: ['a'],\n        allowedAttributes: { a: ['href'] }\n    }\n);\nconsole.log('Control (href):', ctrl);\n// OUTPUT: <a>click</a>   ← href correctly stripped by naughtyHref()\n```\n\n**Observed behavior**: `javascript:` preserved on `action`/`formaction`/`data` but correctly stripped on `href`.\n\n**Expected behavior**: `javascript:` should be stripped on ALL URI-bearing attributes, or at minimum, the library should warn developers when they allow URI-bearing attributes not covered by scheme validation.\n\n## Impact\n\nAn attacker can achieve XSS in applications that use sanitize-html with non-default configurations allowing URI-bearing attributes:\n\n- `<form action=\"javascript:...\">` — XSS on form submission (all modern browsers)\n- `<button formaction=\"javascript:...\">` — per-button XSS override (all modern browsers)\n- `<object data=\"javascript:...\">` — object load XSS (Chrome, Firefox)\n- `<video poster=\"javascript:...\">` — limited browser support but spec-valid\n\n**Common vulnerable configurations**:\n- CMS platforms allowing form elements for user-generated content\n- Form builder applications\n- Rich text editors with extended tag allowlists\n- Email template editors allowing media/embed tags\n\n**Mitigating factors**:\n- Default configuration is NOT vulnerable\n- Requires double opt-in: non-default tag + non-default attribute\n- CSP `form-action` directive mitigates form-based vectors\n- Developers CAN manually add attributes to `allowedSchemesAppliedToAttributes`\n\n## Remediation\n\n**Option 1 (Recommended)**: Expand the default `allowedSchemesAppliedToAttributes` list:\n\n```javascript\n// index.js line 829, change from:\nallowedSchemesAppliedToAttributes: ['href', 'src', 'cite'],\n\n// to:\nallowedSchemesAppliedToAttributes: [\n    'href', 'src', 'cite', 'action', 'formaction',\n    'data', 'poster', 'background', 'ping',\n    'xlink:href', 'dynsrc', 'lowsrc'\n],\n```\n\n**Option 2**: Apply `naughtyHref()` to ALL attributes by default (invert the gate logic).\n\n**Option 3**: Add a runtime warning when developers allow URI-bearing attributes not in `allowedSchemesAppliedToAttributes` (analogous to `vulnerableTags` warning for `script`/`style` at lines 124-129).\n\n## Reporter\n\nKevin Lee (Changseon Lee)\nOPCIA Corp. / PeanutAI Inc.\nSeoul, South Korea\nGitHub: crattack","state":0,"publishedAt":"2026-07-31T21:43:51+00:00","modifiedAt":"2026-07-31T22:00:21.5953477+00:00","affected":[{"ecosystem":"npm","name":"sanitize-html","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.18.0"},{"kind":"fixed","version":"2.17.5"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vccv-cmxp-4j9h","https://nvd.nist.gov/vuln/detail/CVE-2026-53606","https://github.com/apostrophecms/apostrophe/pull/5464","https://github.com/apostrophecms/apostrophe/commit/5a88e9630cbbdde33154ef8abe7557ddf7be418b","https://github.com/apostrophecms/apostrophe","https://github.com/apostrophecms/apostrophe/releases/tag/sanitize-html@2.17.5"],"sourceUrl":"https://github.com/advisories/GHSA-vccv-cmxp-4j9h","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-vccv-cmxp-4j9h","identifiers":["GHSA-vccv-cmxp-4j9h","CVE-2026-53606"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T20:07:23.8593986+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T20:07:23.8593986+00:00","lastSuccessAt":"2026-11-07T20:07:24.014368+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:07:24.014369+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-aac6631b84e101279eb6b1c3835f52bf7b26c50f4d25bc0fb35977235593f4a7","complete":true,"records":420943,"lastAttemptAt":"2026-11-07T20:07:23.1739993+00:00","lastSuccessAt":"2026-11-07T20:07:23.0712879+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:07:23.1739993+00:00","snapshotPublishedAt":"2026-11-07T19:18:33+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c5a2504558b549559b8658a653596391","complete":true,"records":13633,"lastAttemptAt":"2026-11-07T20:19:26.3099435+00:00","lastSuccessAt":"2026-11-07T20:19:26.304+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:19:26.304+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T20:07:23.8593986+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T20:07:23.8593986+00:00","lastSuccessAt":"2026-11-07T20:07:24.0152025+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:07:24.0152028+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-191690d52ba04a91b1a2749fa6191ceb","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T20:07:42.8841875+00:00","lastSuccessAt":"2026-11-07T20:07:42.881+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:07:42.881+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T20:07:23.800032+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:07:23.800032+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T20:07:23.2420378+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:07:23.2420378+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T20:07:23.8227715+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:07:23.8227715+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-07T20:07:23.4659623+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:07:23.4659623+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}