apostrophecms sanitize-html vulnerabilities

14 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Latest apostrophecms sanitize-html vulnerabilities

CVE-2026-113661 — ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs (CVSS 5.4)
CVE-2026-113657 — ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS) (CVSS 3.7)
CVE-2026-113654 — ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render (CVSS 5.3)
CVE-2026-113650 — ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced) (CVSS 5.3)
CVE-2026-53606 — sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and background attributes (CVSS 5.4)
CVE-2026-44990 — Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` (CVSS 9.3)
CVE-2026-40186 — ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements (CVSS 6.1)
CVE-2014-125128 — (CVSS 6.1)
CVE-2019-25225 — (CVSS 6.1)
CVE-2024-21501 — (CVSS 5.3)
CVE-2022-25887 — Regular Expression Denial of Service (ReDoS) (CVSS 7.5)
CVE-2021-26540 — (CVSS 5.3)
CVE-2021-26539 — (CVSS 5.3)
CVE-2016-1000237 — (CVSS 6.1)