{"id":"EUVD-2026-105209","enisaUuid":"18f6b282-e578-3b51-8057-6445a94fd693","description":"ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that allows meta refresh elements and their http-equiv and content attributes can retain unsafe script or redirect destinations embedded in the refresh content value. This issue is fixed in sanitize-html 2.18.0.","datePublished":"Oct 20, 2026, 5:11:20 PM","dateUpdated":"Oct 21, 2026, 3:53:24 PM","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-cv27-6wvh-8x7j\nhttps://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce\nhttps://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350\nhttps://github.com/apostrophecms/apostrophe/releases/tag/sanitize-html@2.18.0\n","aliases":"CVE-2026-113661\nGHSA-cv27-6wvh-8x7j\n","assigner":"GitHub_M","epss":0.26,"enisaIdProduct":[{"id":"92d1e9b7-8bee-3a4e-be1d-3039fe80efa3","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 4.33.0"},{"id":"bb9a3b60-924d-3d1f-b4c2-3fc877f2b4b3","product":{"name":"sanitize-html","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 2.18.0"}],"enisaIdVendor":[{"id":"bde1ec66-9541-3c30-a57a-90d10e9f4b1a","vendor":{"name":"apostrophecms"}}],"enisaIdVulnerability":[{"id":"7494c405-e735-3747-b17b-32a60e04344a","vulnerability":{"id":"CVE-2026-113661","description":"ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that allows meta refresh elements and their http-equiv and content attributes can retain unsafe script or redirect destinations embedded in the refresh content value. This issue is fixed in sanitize-html 2.18.0.","datePublished":"Oct 20, 2026, 5:11:20 PM","dateUpdated":"Oct 21, 2026, 3:53:24 PM","status":"PUBLISHED","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-cv27-6wvh-8x7j\nhttps://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce\nhttps://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350\nhttps://github.com/apostrophecms/apostrophe/releases/tag/sanitize-html@2.18.0\n","enisa_id":"EUVD-2026-105209\n","assigner":"GitHub_M","epss":0.26,"dataProcessed":"Nov 6, 2026, 7:15:43 AM","vulnerabilityProduct":[{"id":"b50edfc5-28ee-3d1b-b299-390d4a85c333","product":{"name":"sanitize-html","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 2.18.0"},{"id":"fb75e540-7276-34b7-8656-91c6809fde38","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 4.33.0"}],"vulnerabilityVendor":[{"id":"30a08d40-1e9f-3964-88c8-b7b6c548d7f9","vendor":{"name":"apostrophecms"}}]}},{"id":"f59d0e56-bc19-3739-a046-15bbfabf2c77","vulnerability":{"id":"GHSA-cv27-6wvh-8x7j","description":"ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv\u003drefresh` `content` still ships `javascript:` / `data:` URLs","datePublished":"Oct 20, 2026, 6:15:33 PM","dateUpdated":"Oct 20, 2026, 6:15:33 PM","baseScore":0.0,"references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-cv27-6wvh-8x7j\nhttps://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce\nhttps://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350\nhttps://github.com/apostrophecms/apostrophe\nhttps://github.com/apostrophecms/apostrophe/releases/tag/sanitize-html@2.18.0\n","enisa_id":"EUVD-2026-105209\n","aliases":"GHSA-cv27-6wvh-8x7j\nCVE-2026-113661\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:08:27 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}