{"id":"EUVD-2026-105209","revision":"e817da8a0b924ac1a5b1cc539c9a8283","records":[{"revision":"e817da8a0b924ac1a5b1cc539c9a8283","observedAt":"2026-10-28T00:54:14.504+00:00","statement":{"source":"euvd","id":"EUVD-2026-105209","aliases":["CVE-2026-113661","GHSA-cv27-6wvh-8x7j"],"title":"ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that allows meta refresh elements and their h…","description":"ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that allows meta refresh elements and their http-equiv and content attributes can retain unsafe script or redirect destinations embedded in the refresh content value. This issue is fixed in sanitize-html 2.18.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","score":5.4,"severity":null}],"references":["https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-cv27-6wvh-8x7j","https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","https://github.com/apostrophecms/apostrophe/releases/tag/sanitize-html@2.18.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105209","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 20, 2026, 5:11:20 PM","dateUpdated":"Oct 21, 2026, 3:53:24 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-105209","identifiers":["EUVD-2026-105209","CVE-2026-113661","GHSA-cv27-6wvh-8x7j"]},"retained":false,"historicalAffected":[]}],"coverage":[]}