{"id":"EUVD-2026-105176","enisaUuid":"7c9ec65c-1ea2-35dd-a923-da42007a2340","description":"ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an \u003ciframe\u003e is not allowed and disallowedTagsMode is \u0027discard\u0027 (the defaults), its raw-text content is re-sanitized by a recursive call to sanitizeHtml(text, options). The recursion has no bound and starts each nested call with a fresh state. This vulnerability is fixed in 2.18.1.","datePublished":"Oct 20, 2026, 4:19:12 PM","dateUpdated":"Oct 28, 2026, 2:02:38 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-c9rx-x947-fp3h\nhttps://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498\nhttps://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea\nhttps://github.com/apostrophecms/apostrophe/releases/tag/sanitize-html@2.18.1\n","aliases":"CVE-2026-113650\nGHSA-c9rx-x947-fp3h\n","assigner":"GitHub_M","epss":0.4,"enisaIdProduct":[{"id":"003da685-272e-38e6-bfe5-b705641d6e11","product":{"name":"sanitize-html","vendor":{"name":"apostrophecms"}},"product_version":"2.18.0, \u003c 2.18.1"},{"id":"485a7202-af24-39ba-baf5-8d5621dc652b","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 4.34.0"}],"enisaIdVendor":[{"id":"fd0609bb-0c18-350f-9741-c1a26787e9bd","vendor":{"name":"apostrophecms"}}],"enisaIdVulnerability":[{"id":"04c9257b-6ee6-3431-b8c7-828f294ce5d8","vulnerability":{"id":"CVE-2026-113650","description":"ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an \u003ciframe\u003e is not allowed and disallowedTagsMode is \u0027discard\u0027 (the defaults), its raw-text content is re-sanitized by a recursive call to sanitizeHtml(text, options). The recursion has no bound and starts each nested call with a fresh state. This vulnerability is fixed in 2.18.1.","datePublished":"Oct 20, 2026, 4:19:12 PM","dateUpdated":"Oct 28, 2026, 2:02:38 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-c9rx-x947-fp3h\nhttps://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498\nhttps://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea\nhttps://github.com/apostrophecms/apostrophe/releases/tag/sanitize-html@2.18.1\n","enisa_id":"EUVD-2026-105176\n","assigner":"GitHub_M","epss":0.4,"dataProcessed":"Oct 30, 2026, 3:00:58 AM","vulnerabilityProduct":[{"id":"449183d6-6359-31a6-98f5-e66b222d56ea","product":{"name":"sanitize-html","vendor":{"name":"apostrophecms"}},"product_version":"2.18.0, \u003c 2.18.1"},{"id":"a0d0307b-b425-3dfa-b0f5-351b69c2167e","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 4.34.0"}],"vulnerabilityVendor":[{"id":"5f57a5c6-4c7f-3366-83de-ff8278073434","vendor":{"name":"apostrophecms"}}]}},{"id":"8481cfd7-d243-392d-bf48-b07ade8eaf82","vulnerability":{"id":"GHSA-c9rx-x947-fp3h","description":"ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)","datePublished":"Oct 21, 2026, 5:05:01 PM","dateUpdated":"Oct 21, 2026, 5:05:01 PM","baseScore":0.0,"references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-c9rx-x947-fp3h\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-113650\nhttps://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498\nhttps://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea\nhttps://github.com/apostrophecms/apostrophe\nhttps://github.com/apostrophecms/apostrophe/releases/tag/sanitize-html@2.18.1\n","enisa_id":"EUVD-2026-105176\n","aliases":"GHSA-c9rx-x947-fp3h\nCVE-2026-113650\n","epss":0.0,"dataProcessed":"Oct 29, 2026, 7:03:23 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}