{"id":"EUVD-2026-105186","enisaUuid":"94a0ef7f-c4ea-3ece-ad58-7c4eb2b2c8e2","description":"ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From sanitize-html 2.17.7 until 2.18.0, an application configuration that permits namespace-prefixed SVG animation elements and the relevant URL-targeting attributes can bypass the SMIL URL protection because prefixed tag names do not match the unprefixed animation-element check. The bypass can rewrite a link destination to an unsafe URI after the sanitized SVG is rendered, with script execution occurring when a user activates the affected link; the default sanitizer configuration is not unconditionally affected. This issue is fixed in sanitize-html 2.18.0.","datePublished":"Oct 20, 2026, 4:54:12 PM","dateUpdated":"Oct 20, 2026, 5:08:06 PM","baseScore":3.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-374f-7chj-9948\nhttps://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce\nhttps://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350\nhttps://github.com/apostrophecms/apostrophe/releases/tag/sanitize-html@2.18.0\n","aliases":"CVE-2026-113657\nGHSA-374f-7chj-9948\n","assigner":"GitHub_M","epss":0.31,"enisaIdProduct":[{"id":"6081e94a-ab52-3d8e-9eed-930611a3550a","product":{"name":"sanitize-html","vendor":{"name":"apostrophecms"}},"product_version":"2.17.7, \u003c 2.18.0"},{"id":"727b9216-bd1f-3948-855d-d2aeb92c32a6","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 4.33.0"}],"enisaIdVendor":[{"id":"bd1fb981-5047-3a83-9012-31825be43e96","vendor":{"name":"apostrophecms"}}],"enisaIdVulnerability":[{"id":"17793193-5502-33d1-8a56-0257fd29e6c2","vulnerability":{"id":"CVE-2026-113657","description":"ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From sanitize-html 2.17.7 until 2.18.0, an application configuration that permits namespace-prefixed SVG animation elements and the relevant URL-targeting attributes can bypass the SMIL URL protection because prefixed tag names do not match the unprefixed animation-element check. The bypass can rewrite a link destination to an unsafe URI after the sanitized SVG is rendered, with script execution occurring when a user activates the affected link; the default sanitizer configuration is not unconditionally affected. This issue is fixed in sanitize-html 2.18.0.","datePublished":"Oct 20, 2026, 4:54:12 PM","dateUpdated":"Oct 20, 2026, 5:08:06 PM","status":"PUBLISHED","baseScore":3.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-374f-7chj-9948\nhttps://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce\nhttps://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350\nhttps://github.com/apostrophecms/apostrophe/releases/tag/sanitize-html@2.18.0\n","enisa_id":"EUVD-2026-105186\n","assigner":"GitHub_M","epss":0.31,"dataProcessed":"Nov 1, 2026, 4:02:47 AM","vulnerabilityProduct":[{"id":"0bccec43-1045-31c6-90f6-451dce7bfa11","product":{"name":"sanitize-html","vendor":{"name":"apostrophecms"}},"product_version":"2.17.7, \u003c 2.18.0"},{"id":"394e5eba-baed-3c86-b84d-7d12351a66a5","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 4.33.0"}],"vulnerabilityVendor":[{"id":"d7df69eb-c575-3649-a319-ebc56acca07d","vendor":{"name":"apostrophecms"}}]}},{"id":"d17a6d77-07c7-39f4-b965-1a8c7c3c92bf","vulnerability":{"id":"GHSA-374f-7chj-9948","description":"ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)","datePublished":"Oct 20, 2026, 6:21:19 PM","dateUpdated":"Oct 20, 2026, 6:21:19 PM","baseScore":0.0,"references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-374f-7chj-9948\nhttps://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce\nhttps://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350\nhttps://github.com/apostrophecms/apostrophe\nhttps://github.com/apostrophecms/apostrophe/releases/tag/sanitize-html@2.18.0\n","enisa_id":"EUVD-2026-105186\n","aliases":"CVE-2026-113657\nGHSA-374f-7chj-9948\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:08:27 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}