ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-84371 · CVE overview and exploitation status

EUVD-2026-69654

GHSA-g8qq-57p8-ggw5

cve-program · CVE-2026-84371

• https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-g8qq-57p8-ggw5
• https://github.com/apostrophecms/apostrophe/pull/5552
• https://github.com/apostrophecms/apostrophe/commit/1135516a1a4a8f9638641c460488a43d8af20081
• https://github.com/apostrophecms/apostrophe/commit/38ff1106c8176b16c2da9872acd9b449adcbb949
• https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md

euvd · EUVD-2026-69654

• https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-g8qq-57p8-ggw5
• https://github.com/apostrophecms/apostrophe/pull/5552
• https://github.com/apostrophecms/apostrophe/commit/1135516a1a4a8f9638641c460488a43d8af20081
• https://github.com/apostrophecms/apostrophe/commit/38ff1106c8176b16c2da9872acd9b449adcbb949
• https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md

nvd · CVE-2026-84371

• https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md
• https://github.com/apostrophecms/apostrophe/commit/1135516a1a4a8f9638641c460488a43d8af20081
• https://github.com/apostrophecms/apostrophe/commit/38ff1106c8176b16c2da9872acd9b449adcbb949
• https://github.com/apostrophecms/apostrophe/pull/5552
• https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-g8qq-57p8-ggw5

osv · GHSA-g8qq-57p8-ggw5

• https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-g8qq-57p8-ggw5
• https://github.com/apostrophecms/apostrophe/pull/5552
• https://github.com/apostrophecms/apostrophe/commit/1135516a1a4a8f9638641c460488a43d8af20081
• https://github.com/apostrophecms/apostrophe/commit/38ff1106c8176b16c2da9872acd9b449adcbb949
• https://github.com/apostrophecms/apostrophe
• https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md

• ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js validates an animation value at… · Advisory content revised · 5 Nov 2026